{"id":32017,"date":"2026-10-02T08:32:12","date_gmt":"2026-10-02T00:32:12","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-51886"},"modified":"2026-10-02T08:32:12","modified_gmt":"2026-10-02T00:32:12","slug":"cve-2026-51886","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-51886","title":{"rendered":"CVE-2026-51886 &#8211; langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitra"},"content":{"rendered":"<p>langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src\/backend\/base\/langflow\/api\/v1\/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile\/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src\/backend\/base\/langflow\/api\/v1\/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the \/api\/v1\/validate\/code endpoint, which directly executes user-supplied code without sandboxing or security controls.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src\/backend\/base\/langflow\/api\/v1\/validate.py:validate-post_validate_code-a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-32017","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/32017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=32017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=32017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=32017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}