ENDOR-VUL-2026-26012

Description: POST /api/v1/custom_component accepts a JSON code field holding raw Python and executes it to build the component class. The sink is exec() with no sandbox. The handler is at src/backend/base/langflow/api/v1/endpoints.py:873-892, and exec() appears at seven distinct points in validate.py (lines 66, 140, 165, 182, 227, 397, 442).

POST /api/v1/custom_component
  -> Component(_code=raw_code.code)
  -> eval_custom_component_code()
  -> create_class()
  -> exec(compiled_class, exec_globals, exec_locals)     # validate.py:442
  -> __init__ runs during instantiation
  -> arbitrary commands execute

Because instantiation happens during validation, the payload never needs to be invoked. Put it in __init__ and it fires the moment Langflow checks whether the component is valid. Verified with captured command execution.

Impact: Code Execution, authenticated, and pre-authentication where LANGFLOW_SKIP_AUTH_AUTO_LOGIN is set. Runs with the privileges of the Langflow service process.

Operators who do not need LLM-generated code execution should set LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true, which fails closed. Removing the capability beats caging it.

GitHub Security Advisory GHSA-8xrc-2jr4-78j7 was assigned for this finding and is still not public as of 2026-08-24, so there is no advisory page to cite and no published CVSS score to quote. Reported 2026-01-26, with repeated attempts to reach the maintainer; the fix status is undetermined. Disclosed at DEF CON 34 under a 90+30 day disclosure timeline. This record will be re-keyed to the GHSA when the advisory publishes. Full analysis is in the technical whitepaper.