Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.

The version of Langflow installed on the remote host is prior to 1.9.2. It is, therefore, affected by multiple vulnerabilities:

  - The Shareable Playground feature enables execution of workflows by unauthenticated users.
    When the route /api/v1/build_public_tmp executes a flow, it allows providing arbitrary     custom Python code as the nodes code inside the JSON payload, resulting in remote code     execution. (CVE-2026-48519)

  - By controlling files that are digested into the RAG, an attacker can direct components     based on BaseFileComponent to read any file on the filesystem by absolute path. Affected     components include Docling, Read File, NVIDIA Retriever Extraction, Video File, and     Unstructured API. (CVE-2026-55447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Langflow running on the remote host is prior to 1.9.2. It is, therefore, affected by a multiples vulnerabilities :

- An Unauthenticated RCE in Shareable Playgrounds

- An RCE through BaseFileComponent

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the
    "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable
    Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a
    link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a
    public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as
    the nodes code, inside the JSON payload. The vulnerable field is
    data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2. (CVE-2026-48519)

ID	Name	Product	Family	Severity
326243	Langflow < 1.9.2 Multiple Vulnerabilities	Nessus	Artificial Intelligence	critical
115275	Langflow < 1.9.2 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	critical
443285	SCA: security update for langflow (GHSA-v5ff-9q35-q26f)	Tenable Cloud Security	SCA Checks	critical
443285	SCA: security update for langflow (GHSA-v5ff-9q35-q26f)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-48519

critical

Tenable Plugins

critical

critical

critical

critical