## https://sploitus.com/exploit?id=81AF37E3-C535-56D1-BC46-2EE165A8A66E
# CVE-2026-0770: Langflow exec_globals Remote Code Execution
**CVSS 9.8 (Critical)** | **ZDI-CAN-27325** | **CWE-829: Inclusion of Functionality from Untrusted Control Sphere**
## Overview
CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in [Langflow](https://github.com/langflow-ai/langflow), a low-code application framework for building LLM-powered apps. The flaw resides in the `/api/v1/validate` endpoint where the `exec_globals` parameter is unsafely passed to Python's `exec()` function, allowing unauthenticated attackers to execute arbitrary code with the privileges of the Langflow process (typically root).
Discovered through the Zero Day Initiative (ZDI-CAN-27325).
## Technical Details
### exec_globals Injection
The Langflow validate endpoint at `/api/v1/validate` accepts a JSON payload containing a `exec_globals` field. This dictionary is intended for internal use to pre-populate global variables during validation of custom components. However, the endpoint does not sanitize or restrict the contents of `exec_globals`, and the values are passed directly into Python's built-in `exec()` function:
```python
exec(user_code, exec_globals)
```
An attacker can inject arbitrary Python code by providing a crafted `exec_globals` dictionary that overrides built-in functions or injects malicious callables. When Langflow internally evaluates the user code with these globals, the injected code executes.
### CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The vulnerability is classified as CWE-829 because the application includes functionality (via `exec_globals`) from an untrusted source (the network request) without adequate validation, leading to arbitrary code execution.
### Attack Vector
- **Network**: Remote
- **Authentication**: None required
- **Complexity**: Low
- **Impact**: Complete compromise of confidentiality, integrity, and availability
## Affected Versions
All Langflow versions prior to the patch implementing proper sanitization of `exec_globals` in the validate endpoint are affected. Specific affected versions include:
- Langflow 0.x series through early 2026
- Versions where `/api/v1/validate` accepts `exec_globals` without validation
## Reproduction Steps
1. Deploy a vulnerable Langflow instance (or use a lab environment with explicit authorization)
2. Send a crafted POST request to `/api/v1/validate` with a malicious `exec_globals` payload
3. Observe that the injected command executes on the target system
## Proof of Concept
Use the included `exploit.py` script:
```
python exploit.py --target 192.168.1.100 --port 7860 --command "id > /tmp/pwned"
```
## Mitigation
1. **Patch**: Upgrade Langflow to the patched version that sanitizes `exec_globals`.
2. **Workaround**: Restrict network access to the Langflow API endpoint with a firewall or reverse proxy.
3. **Defense in Depth**: Do not expose Langflow directly to untrusted networks.
## References
- [ZDI-26-000 (ZDI-CAN-27325)] https://www.zerodayinitiative.com/advisories/ZDI-26-000/
- [Langflow GitHub] https://github.com/langflow-ai/langflow
- [CWE-829] https://cwe.mitre.org/data/definitions/829.html
- [NVD CVE-2026-0770] https://nvd.nist.gov/vuln/detail/CVE-2026-0770
---
**Disclaimer**: This information is provided for educational purposes and authorized security testing only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.