Tools AI Risk Radar ai-incident-0167
Incident record
Langflow fixes code execution during Python validation
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- langflow
- Actor
- researcher
- CVE
- CVE-2026-51886
What happened
An authenticated user could submit Python function decorators that executed while the server was checking the code. The validation step ran those expressions with the application’s permissions.
langflow: affected >= 1.7.2, < 1.10.1; fixed in 1.10.1. The date shown is the maintainer’s original disclosure date. Its advisory assigns 8.8 under CVSS 3.1.
Sources
- Primary disclosuregithub.com/langflow-ai/langflow/security/advisories/GHSA-w58…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026