langflow-ai langflow Bundle URL Loader code injection

An attacker who can influence bundle URLs or a deployment template can supply a malicious remote archive containing a Python custom component. The Langflow server fetches the bundle, places the component on its search path, and imports the Python code during startup or bundle processing, which executes arbitrary module-level code [ref_id=1]. This is a code injection via untrusted code loading, corresponding to CWE-94 and CWE-829 [ref_id=1]. The attack is described as local in the CVE description, but the researcher notes the CVSS network vector suggests remote exploitation may be possible if bundle URLs are low-privilege configurable [ref_id=1].

The vulnerability resides in Langflow's bundle URL loading mechanism and custom component discovery/import path. When a bundle URL is fetched, custom component files inside the archive are placed on component search paths and their Python code is imported during startup without any trust boundary or signature verification [ref_id=1].

No patch is available; the vendor did not respond to the disclosure [ref_id=1]. The researcher recommends not auto-importing remote custom component code, requiring explicit trust approval, signatures or allowlists, sandboxing component loading, and disabling remote bundle URLs by default in production [ref_id=1].