#VU121169 Inclusion of Functionality from Untrusted Control Sphere in Langflow - CVE-2026-0770

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU121169

#VU121169 Inclusion of Functionality from Untrusted Control Sphere in Langflow - CVE-2026-0770

Published: January 12, 2026 / Updated: February 13, 2026


Vulnerability identifier: #VU121169
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2026-0770
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Langflow
Software vendor:
Langflow

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to inclusion of functionality from untrusted control sphere within the handling of the exec_globals parameter provided to the validate endpoint. A remote attacker can execute arbitrary code on the system.


Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links