Langflow Remote Code Execution Vulnerability via Untrusted exec_globals Parameter

A remote code execution vulnerability has been identified in Langflow. This issue arises from the handling of the exec_globals parameter in the validate endpoint, allowing remote attackers to execute arbitrary code on the affected system. The vulnerability stems from including a resource from an untrusted control sphere, enabling code execution with root privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected Langflow installation, with the executed code running in the context of the root user.

Remediation

Given the nature of this vulnerability, the primary mitigation strategy is to limit interaction with the Langflow product.