CVE-2024-42835: langflow has vulnerability in PythonCodeTool component
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Published Oct 31, 2024 · Updated Jun 6, 2026
Affected packages
langflow
- Ecosystem
- PyPI
- Affected
- <= 1.0.12
- Fixed in
- No patched version yet
- Check
pip show langflow
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Langflow vulnerabilities
All Langflow entriesCVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
critical9.9Oct 7, 2026CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
medium5.4Oct 7, 2026CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
high7.1Oct 7, 2026CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
high7.1Oct 7, 2026CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
critical9.9Oct 6, 2026GHSA-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
medium6.3Oct 6, 2026