Main
Vulnerability Database
Exploits
ID:12396 - Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow - CVE-2026-0770
ID:12396 - Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow - CVE-2026-0770
Published: February 13, 2026
Vulnerability identifier: #VU121169
Vulnerability risk: High
CVE-ID: CVE-2026-0770
CWE-ID: CWE-829
Exploitation vector: Remote access
Vulnerable software:
Langflow
Langflow
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to inclusion of functionality from untrusted control sphere within the handling of the exec_globals parameter provided to the validate endpoint. A remote attacker can execute arbitrary code on the system.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.