Loading vulnerability…
CVE-2026-0768 is an unauthenticated code-injection vulnerability in Langflow's custom component editor code validator. Insufficient validation of an attacker-controlled code parameter permits the supplied string to be executed as Python code. Affected Langflow releases through version 1.4.2 can be exploited remotely, and execution occurs in the context of the Langflow process, reported as root in affected deployments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This 14-file repository packages an operational Python proof-of-concept suite and a Docker lab for claimed CVE-2026-0768, a Langflow code-injection/RCE issue. The substantive content is under CVE-2026-0768-exploitintel/: three standard-library-only Python PoCs, Docker Compose configuration, a one-line Dockerfile using langflowai/langflow:v1.1.1, and extensive verification/intelligence documentation. All PoCs contact a target over HTTP, optionally check GET /health, then POST JSON to /api/v1/validate/code. They exploit server-side exec() of parsed Python FunctionDef nodes through three evaluation paths: default arguments (poc.py), generator-thrown exceptions for clean stdout/stderr capture (poc_vector2.py), and decorators (poc_vector3.py). Command output is intentionally surfaced through function.errors in an HTTP 200 response, enabling one-request command execution and output retrieval. The bundled lab maps localhost:17860 to container port 7860 and enables auto-login. The root README is materially unrelated to the embedded PoCs and includes a curl-to-Bash external download command; that command is not used by the exploit scripts but should be treated as an independent supply-chain concern. No exploit framework is used, and the code appears to be a genuine, command-customizable PoC rather than a detection-only or fake exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in Langflow's custom component editor code validator. Improper validation of a user-supplied string permits arbitrary Python execution as root. It affects all Langflow releases through version 1.4.2 and is being exploited for reconnaissance and credential harvesting.
A critical Langflow input-validation flaw that permits arbitrary Python-code execution as root.
A Langflow vulnerability involving the code parameter on POST /api/v1/validate/code and sharing the same underlying code-execution mechanism as the other validate/code CVEs.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.