# CVE-2026-33017

## Summary

Unauthenticated RCE in Langflow via public flow build endpoint

## Description

The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow (<1.9.0) accepts attacker-controlled data containing arbitrary Python code in custom component nodes. The unauthenticated endpoint passes the provided data to start_flow_build(), which builds a graph and executes the custom component code via exec() without sandboxing. This allows an unauthenticated, remote attacker to obtain RCE with a single HTTP request. Affected: langflow pypi <1.9.0. Fixed: 1.9.0. Setup: run a vulnerable Langflow instance (e.g., langflowai/langflow:1.8.1 or pip install langflow==1.8.1), create a public flow, then POST to the public build endpoint with a custom component whose top-level code contains an os.system() payload. CISA KEV added 2026-03-25.

## Metadata

- Product: langflow
- Severity: critical
- Status: open