Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-7687

langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

At a glance

Severity
MEDIUM 5.3
EPSS
EPSS 3.00 % · percentile 87 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
VulDB
NVD status
Deferred

Description

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lfx/src/lfx/custom/code_parser/code_parser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

VersionScoreVectorScored by
CVSS 4.0MEDIUM 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
CVSS 3.1MEDIUM 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
CVSS 3.0MEDIUM 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
CVSS 2.0MEDIUM 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:URVulDB
CVSS 4.0LOW 2.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · cna@vuldb.com (Secondary)
CVSS 3.1MEDIUM 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LNVD · cna@vuldb.com (Secondary)
CVSS 2.0MEDIUM 6.5AV:N/AC:L/Au:S/C:P/I:P/A:PNVD · cna@vuldb.com (Secondary)

Weaknesses (CWE)

European references

Affected products

ProductVersions
langflow-ai · langflowaffected 1.8.0 ; affected 1.8.1 ; affected 1.8.2 ; affected 1.8.3 ; affected 1.8.4

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD