CVE-2026-0771

{"id": "CVE-2026-0771", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0771", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-24T04:55:33.963690Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Langflow", "product": "Langflow", "versions": [{"status": "affected", "version": "1.4.2"}], "defaultStatus": "unknown"}]}], "published": "2026-01-23T04:16:04.200", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-037/", "tags": ["Third Party Advisory"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product.\n\nThe specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497."}, {"lang": "es", "value": "Vulnerabilidad de Inyecci\u00f3n de C\u00f3digo PythonFunction de Langflow con Ejecuci\u00f3n Remota de C\u00f3digo. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Langflow. Los vectores de ataque y la explotabilidad variar\u00e1n dependiendo de la configuraci\u00f3n del producto.\n\nLa falla espec\u00edfica existe dentro del manejo de los componentes de funci\u00f3n Python. Dependiendo de la configuraci\u00f3n del producto, un atacante podr\u00eda ser capaz de introducir c\u00f3digo Python personalizado en un flujo de trabajo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de la aplicaci\u00f3n. Fue ZDI-CAN-27497."}], "lastModified": "2026-06-17T10:11:21.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81AAA7F9-843A-456C-89A1-B99D18AD4328"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}