●PocketClawAI security alerts
Sign in
mediumCVSS 6.3NVD status: Deferred

CVE-2026-7687

Langflow: A vulnerability was determined in langflow-ai langflow up to 1.8.4.

ComponentLangflow
Severitymedium (CVSS 6.3)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published (NVD)2026-05-03
Last modified2026-06-17
Affected versions
<= 1.8.4
read from the advisory text: NVD has not published CPE data yet
Fixed insee the vendor advisory
WeaknessCWE-74CWE-77
CISA KEVnot listed

NVD description

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lfx/src/lfx/custom/code_parser/code_parser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Does CVE-2026-7687 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Langflow.
Check my stack

What to do

  • NVD lists no fixed version yet: follow the vendor advisory below and keep Langflow off the public internet until a fix ships.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other Langflow CVEs

high
CVE-2026-88962CVSS 8.8

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code...

Langflow
2026-10-07high
CVE-2026-93445CVSS 8.1

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of gener...

Langflow
2026-10-07high
CVE-2026-103360CVSS 8.1

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation...

Langflow
2026-10-07critical
CVE-2026-104334CVSS 9.8

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Langflow
2026-10-07high
CVE-2026-93443CVSS 7.5

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization o...

Langflow
2026-10-07high
CVE-2026-93447CVSS 7.5

IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious...

Langflow
2026-10-07

All Langflow CVEs