CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...".
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.47% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- langflow (pip) >= 1.1.2, < 1.10.3, fixed in 1.10.3 · GHSA-w794-rj3p-xv45
- langflow-base (pip) >= 0.1.2, < 0.10.3, fixed in 0.10.3 · GHSA-w794-rj3p-xv45
- lfx (pip) < 1.10.3, fixed in 1.10.3 · GHSA-w794-rj3p-xv45