GHSA-9fpm-3445-2vx4

Description: Langflow's Smart Transform node asks an LLM to write a Python lambda that transforms its input, then evaluates the model's response. _validate_lambda in src/lfx/src/lfx/components/llm_operations/lambda_filter.py is the entire control, and it checks two things:

def _validate_lambda(self, lambda_text: str) -> bool:
    """Validate the provided lambda function text."""
    return lambda_text.strip().startswith("lambda") and ":" in lambda_text

# ...
return eval(lambda_text)  # noqa: S307

Starts with lambda, contains a colon. A syntactic shape check was promoted to a security boundary. lambda x: __import__("os").system("id") satisfies both conditions, eval() builds it against Python's full builtins, and the subsequent fn(data) call runs it in the Langflow process. A flow author reaches this directly through the Instructions field; where a flow routes attacker-controlled content into Smart Transform, an attacker reaches it by prompt injection, subject to the model following the injected instruction. The path needs no API call and no code editor, only a chat message. Affects Langflow 1.3.0 through 1.10.2.

Impact: Code Execution. Runs with the privileges of the Langflow service process, exposing the credentials, files, application data, and network reachable from it, and other tenants in a shared deployment.

Fixed in 1.10.3 and 1.11.0 by validating the generated code's AST and evaluating it against a restricted builtins mapping. Reported 2026-01-26 and advised 2026-08-04. Four other researchers filed duplicate reports against the same node before the advisory published. Full analysis is in the technical whitepaper.