CVE-2026-0769

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 41.22%
EPSS Percentile: 98.67%
CISA KEV: Not listed

Description

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.

Technical Details

CVSS Version: 3.0
CNA / NVD Source: [email protected]
Published: 23-Jan-2026 11:16
Last Modified: 17-Jun-2026 17:11
EPSS Date: 2026-10-22
CWE: CWE-95

CVSS Vector


            CVSS:3.0                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

langflow / langflow
Version / affected range: 1.3.2
cpe:2.3:a:langflow:langflow:1.3.2:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 23-Oct-2026 07:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), Metasploit Adds Exploit Modules for Langflow, OpenCTI, Grafana and More
VulnCheck has seen more than 15,000 attacks successfully exploiting Langflow instances vulnerable to three of the known exploited flaws, namely CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. Attackers Exploit Critical Langflow Remote Code Execution Flaw

CVE (11)

People (11)

MITRE ATT&CK (2)

Products (6)

Tools (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.