{"data":{"id":"a85571c9-2de9-4897-89cf-44502d82d129","title":"CVE-2026-0770: Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability…","summary":"A remote attacker can execute arbitrary code on affected Langflow installations without authentication. The flaw lies in how the validate endpoint handles the exec_globals parameter, which results from including a resource from an untrusted control sphere. Exploitation grants code execution in the context of root.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0770","publishedAt":"2026-01-23T09:16:04.063Z","cveId":"CVE-2026-0770","cweIds":["CWE-829"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.7.3"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow remote code execution through exec_globals in the validate endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.62562,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":"2026-07-21","advisoryAliases":["GHSA-g22f-v6f7-2hrh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:11.230Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-437"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}