{"data":{"id":"f12fa6ab-4972-4cae-a3e0-e0e361ea4868","title":"CVE-2026-7700: A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file…","summary":"CVE-2026-7700 is a weakness in langflow-ai langflow up to 1.8.4, in the eval function of src/lfx/src/lfx/components/llm_operations/lambda_filter.p within LambdaFilterComponent. A manipulation can lead to code injection, and the attack can be performed remotely. A public exploit exists, and the vendor did not respond to early disclosure contact.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7700","publishedAt":"2026-05-03T15:15:59.693Z","cveId":"CVE-2026-7700","cweIds":["CWE-74","CWE-94"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@>= 1.3.0, < 1.10.3 (fixed: 1.10.3)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow code injection in eval of lambda_filter component","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00314,"epssCheckedAt":"2026-11-09T12:10:44.456Z","kevDateAdded":null,"advisoryAliases":["GHSA-9fpm-3445-2vx4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:57.075Z","patchAvailable":true,"disclosureDate":"2026-05-03T15:15:59.693Z","fixReleasedAt":"2026-07-23T15:24:52.070Z","daysToFix":81,"fixCheckedAt":"2026-10-29T21:37:04.213Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.10.3","matchedVersion":"1.10.3","fixReleasedAt":"2026-07-23T15:24:52.070Z","daysToFix":81,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:04.065Z"}]}}