AI agent vulnerability · Langflow

GHSA-hhxr-7j22-694r: Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution

lowCVSS 4.0 2.1 · 3.1 6.3

This advisory was withdrawn on Oct 5, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9fpm-3445-2vx4. This link is maintained to preserve external references. Original Description A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.p of the component LambdaFilterComponent.

Published May 3, 2026 · Updated Oct 5, 2026

Affected packages

langflow

Ecosystem: PyPI
Affected: >= 1.3.0, < 1.10.3
Fixed in: No patched version yet
Check: pip show langflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9fpm-3445-2vx4. This link is maintained to preserve external references.

Original Description

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Langflow vulnerabilities

All Langflow entries