Loading vulnerability…
CVE-2026-0768 is a critical code-injection vulnerability in Langflow's custom-component editor code validator. The validate endpoint inadequately validates an attacker-controlled code parameter before using it in Python code execution. A remote unauthenticated attacker can submit crafted input to cause arbitrary Python execution in the root context. The vulnerability affects Langflow releases through version 1.4.2.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This is a minimal two-file proof-of-concept repository: README.md documents invocation, while poc.py is the sole executable Python exploit. poc.py uses argparse to require a Langflow URL (-u/--url) and a Bash command (-c/--command), then sends a JSON POST request to the target base URL plus /api/v1/validate/code. Its code payload exploits server-side validation of attacker-controlled Python by importing subprocess, running `/bin/bash -c <command>` with shell execution enabled, and embedding captured stdout/stderr into a raised exception. A 200 response is parsed and printed; other HTTP statuses and connection failures cause errors. The imported requests.get function is unused. No persistence, callback listener, scanning, authentication bypass beyond the claimed unauthenticated endpoint access, or post-exploitation automation is included.
This 14-file repository packages an operational Python proof-of-concept suite and a Docker lab for claimed CVE-2026-0768, a Langflow code-injection/RCE issue. The substantive content is under CVE-2026-0768-exploitintel/: three standard-library-only Python PoCs, Docker Compose configuration, a one-line Dockerfile using langflowai/langflow:v1.1.1, and extensive verification/intelligence documentation. All PoCs contact a target over HTTP, optionally check GET /health, then POST JSON to /api/v1/validate/code. They exploit server-side exec() of parsed Python FunctionDef nodes through three evaluation paths: default arguments (poc.py), generator-thrown exceptions for clean stdout/stderr capture (poc_vector2.py), and decorators (poc_vector3.py). Command output is intentionally surfaced through function.errors in an HTTP 200 response, enabling one-request command execution and output retrieval. The bundled lab maps localhost:17860 to container port 7860 and enables auto-login. The root README is materially unrelated to the embedded PoCs and includes a curl-to-Bash external download command; that command is not used by the exploit scripts but should be treated as an independent supply-chain concern. No exploit framework is used, and the code appears to be a genuine, command-customizable PoC rather than a detection-only or fake exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability affecting Langflow versions 1.2.x and earlier, as indicated by the reference title.
A critical Langflow arbitrary Python code-execution vulnerability that can yield root-level execution on vulnerable systems.
Critical unauthenticated remote code execution vulnerability in Langflow's custom-component-editor code validator. Insufficient validation of a user-supplied code string passed to the validate endpoint enables arbitrary Python execution, potentially as root.
A critical unauthenticated remote code-execution vulnerability in Langflow caused by insufficient validation of user-supplied data. Successful exploitation permits attackers to upload and execute code with root privileges, fully compromising the instance.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.