CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
(updated )
Langflow’s built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any authenticated user who could edit and run a flow could achieve remote code execution and, from there, escalate privileges to superuser (e.g. by opening a database session and flipping is_superuser) or compromise the host.
This issue is fixed as of 1.10.1, with additional hardening through 1.12.3. See Remediation below.
References
- github.com/advisories/GHSA-8qpj-27x8-pwpq
- github.com/langflow-ai/langflow/commit/2754c84aad1306f463db1c3bbb3e8ffbe85da77d
- github.com/langflow-ai/langflow/pull/13700
- github.com/langflow-ai/langflow/releases/tag/v1.10.1
- github.com/langflow-ai/langflow/security/advisories/GHSA-8qpj-27x8-pwpq
- nvd.nist.gov/vuln/detail/CVE-2026-10561
- www.ibm.com/support/pages/node/7277242
Code Behaviors & Features
Detect and mitigate CVE-2026-10561 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →