Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

CVE-2026-0770

githubexploit · 2026-05-23

Description

This exploit enables inclusion of functionality from an untrusted control sphere in Langflow.

Entry point

Parametercode · request body

Path/api/v1/validate/code

Remote code execution via exec_globals in validate endpoint allowing unauthenticated RCE.

Affected Langflow versions

Langflow≤ 1.7.3

All known vulnerabilities by product

Langflow

CVSS 9.8 for CVE-2026-0770

9.8

HIGH SEVERITY

Version 3.0

VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

63.4%higher than 99.1% of all CVEs

Updated 2026-08-25

Exploit Details

Modified:2026-05-23 21:28

Last Seen:2026-05-23 21:30

Reporter:w666-glitch

Written in:Python

Last commit:2026-05-23

Other exploits for CVE-2026-0770

CVE-2026-0770

2026-08-25 KitPloitKITPLOIT

CVE-2026-0770

2026-08-25 KitPloitKITPLOIT

CVE-2026-0770

2026-08-25 KitPloitKITPLOIT

cve-2026-0770-langflow_rce_reproduction

2026-08-25 KitPloitKITPLOIT

CVE-2026-0770

2026-08-25 KitPloitKITPLOIT

New release PoC-in-GitHub

2026-07-25 KitPloitKITPLOIT

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

2026-07-23 razureinkGITHUB

Langflow 1.3.0 - Remote Code Execution

2026-05-29 DiamorphineEXPLOITDBPython

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=AC1F8429-BAD6-5D3D-8AF3-41CCD89A601E
No description provided

Exploit Code

Share

Share on social media: