CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandbox
Before 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser.
What it is
The PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent passed user- or model-supplied code to LangChain's PythonREPL, which is not a security sandbox, and ran it in-process.
The import allow-list didn't hold: the exec globals never set __builtins__, so __import__, open, eval and exec stayed reachable even in the default configuration.
Locked-down instances with allow_custom_components=False were still exposed, because the components didn't check that policy before running code. The reported proof of concept opens a database session and sets is_superuser on the attacker's account.
How to check
- Affected: langflow (pip) < 1.10.1, and the lfx package that ships the component.
- Check whether any flow on your instance uses the Python Interpreter or Python REPL Tool component, and who can edit flows.
How to fix
- Upgrade langflow to 1.10.1 or later. The maintainers recommend 1.12.3 or later for the full hardening series.
- If you don't need the interpreter, set LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false or LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true.
- Run Langflow as an unprivileged user with least-privilege database credentials. For untrusted code, the advisory suggests LANGFLOW_SANDBOX_BACKEND for microVM isolation.
pip show langflow | grep Version