Langflow 1.3.0 contains a remote code execution vulnerability (CVE-2026-0770) due to untrusted input in the exec_globals parameter at the validate endpoint, allowing remote attackers to execute arbitrary code as root without authentication, as demonstrated by a public exploit.
langflow 1.3.0 +3
remote-code-execution
webapps
langflow
1r
1t
5i
updated