{"data":{"id":"101f347b-3bf0-471f-a4b9-c1943b99fdc6","title":"CVE-2026-7687: A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function…","summary":"CVE-2026-7687 is a vulnerability in langflow-ai langflow up to 1.8.4, affecting the function CodeParser.parse_callable_details in src/lfx/src/lfx/custom/code_parser/code_parser.py within the Full Builtins Module Handler component. Manipulating this function can lead to command injection, and the attack can be executed remotely. The exploit has been publicly disclosed, and the vendor did not respond after early contact.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7687","publishedAt":"2026-05-03T09:16:03.680Z","cveId":"CVE-2026-7687","cweIds":["CWE-74","CWE-77"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow command injection in CodeParser.parse_callable_details","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.02999,"epssCheckedAt":"2026-11-10T00:11:23.429Z","kevDateAdded":null,"advisoryAliases":["GHSA-pprg-5xr3-4qr4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:14.293Z","patchAvailable":null,"disclosureDate":"2026-05-03T09:16:03.680Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}