CVE-2026-10561: Langflow PythonREPLComponent Unsandboxed Code Execution Vulnerability
Summary
CVE-2026-10561: Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows... Affects langflow versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework that facilitates the creation of applications using language models. It provides various components, including the PythonREPLComponent, which allows users to execute Python code within flows. However, this functionality has led to a critical vulnerability due to the lack of effective sandboxing, allowing authenticated users to execute arbitrary code with the privileges of the Langflow service.
Vulnerability Detail
The vulnerability arises from the PythonREPLComponent and the legacy PythonREPLToolComponent executing arbitrary user-supplied Python code without proper sandboxing. This code runs in-process with the privileges of the Langflow service, enabling any authenticated user who can edit and run a flow to achieve remote code execution (RCE) and escalate privileges to superuser. The root cause is code injection, where raw input is passed to LangChain's PythonREPL, which is not a security sandbox. Two main weaknesses contributed to this issue: unrestricted builtins that allowed access to critical functions and a lack of server-policy checks that failed to prevent code execution even in locked-down deployments.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.1
This is the first release that contains the fix.
pip install --upgrade "langflow==1.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For immediate mitigation, set the environment variable LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false or LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true to disable the interpreter entirely. This will prevent any execution of untrusted code.
Conclusion
The Langflow vulnerability CVE-2026-10561 poses a significant risk due to unsandboxed code execution capabilities. It is crucial for users to upgrade to the patched version to mitigate the risks associated with this vulnerability. Implementing the recommended workarounds can provide immediate protection while awaiting updates.
See every vulnerability recorded for langflow →
FAQ
CVE-2026-10561 is a critical vulnerability in Langflow's PythonREPLComponent that allows authenticated users to execute arbitrary Python code, leading to remote code execution and privilege escalation.
Any authenticated user of Langflow who can edit and run flows is potentially affected by this vulnerability.
The vulnerability allows authenticated users to execute arbitrary commands with the service's privileges, escalate their accounts to superuser, and potentially compromise the host system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
