Langflow 1.3.0 contains a remote code execution vulnerability (CVE-2026-0770) due to untrusted input in the exec_globals parameter at the validate endpoint, allowing remote attackers to execute arbitrary code as root without authentication, as demonstrated by a public exploit.
langflow 1.3.0 +2
remote-code-execution
webapps
langflow
1r
1t
1c
updated