{
  "claim": {
    "argus_claim_ref": null,
    "attacker_control": "HTTP request payload or parameters",
    "claimed_surface": "api_remote",
    "expected_impact": "code_execution",
    "finding_id": null,
    "id": null,
    "required_entrypoint_detail": "/api/v1/build_public_tmp/{flow_id}/flow",
    "required_entrypoint_kind": "endpoint",
    "submission_reason": "ticket_derived",
    "trigger_class": "service_api",
    "upstream_verdicts": null
  },
  "latest_description": "The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow (<1.9.0) accepts attacker-controlled data containing arbitrary Python code in custom component nodes. The unauthenticated endpoint passes the provided data to start_flow_build(), which builds a graph and executes the custom component code via exec() without sandboxing. This allows an unauthenticated, remote attacker to obtain RCE with a single HTTP request. Affected: langflow pypi <1.9.0. Fixed: 1.9.0. Setup: run a vulnerable Langflow instance (e.g., langflowai/langflow:1.8.1 or pip install langflow==1.8.1), create a public flow, then POST to the public build endpoint with a custom component whose top-level code contains an os.system() payload. CISA KEV added 2026-03-25.",
  "product": "langflow",
  "severity": "critical",
  "status": "open",
  "summary": "Unauthenticated RCE in Langflow via public flow build endpoint",
  "ticket_id": "CVE-2026-33017"
}