Database/AI/ML frameworks & serving
Langflow: authenticated user reaches eval() through component input options and runs code on the host
Impact
Langflow builds a Literal type string by interpolating a component's input option values and passes it straight to eval(), so an object whose __repr__ returns attacker-chosen Python executes when the component is turned into a LangChain tool - including on an ordinary custom-component save through the API. On a GPU fleet Langflow usually runs as a long-lived pod next to the models it orchestrates and holds the credentials for them, so code execution there means the model endpoints, API keys and any mounted model storage that pod can reach. The record rates the required privilege as high, so this is an escalation from a trusted Langflow user to code on the serving host rather than an unauthenticated path.
Who can reach it
A user already authenticated to Langflow with permission to create or save custom components, over the network. No node-level access is needed.
What to do
Upgrade Langflow to 1.12.0 or later and restart the Langflow deployment; no node drain or reboot. Where an upgrade has to wait, restrict who can author or save custom components and treat the Langflow pod's service account and model credentials as exposed if untrusted users had that permission.
References
Related entries
- vLLM: out-of-bounds read in Mamba2 mixer reachable from a completions requestCVE-2026-105775 · vLLM (Mamba2 mixer conv_ssm_forward, completions request handler)Low
- vLLM: engine crash via the penalty handler when prompt embeds are combined with penaltiesCVE-2026-105922 · vLLM (penalty handler, get_token_bin_counts_and_mask in model_executor/layers/utils.py)Low
- sherpa-onnx: unvalidated vocab_size in model metadata overflows a buffer in the transducer greedy decoderCVE-2026-108954 · sherpa-onnx OfflineTransducerGreedySearchDecoder (model-supplied vocab_size)Low
- finetrainers: code injection through the library field of a model indexCVE-2026-124588 · Hugging Face finetrainers (model index loader, resolve_component_cls)Low
- mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference serverCVE-2026-75090 · mistral.rs GGUF tokenizer (convert_gguf_to_hf_tokenizer)Low
- Ollama: integer overflow in the GGUF v1 string reader when parsing a crafted model fileCVE-2026-86289 · Ollama GGUF decoder (readGGUFV1String in fs/ggml/gguf.go)Low
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.