Detections
Analytics
SCA: security update for langflow (GHSA-w584-2h2r-2hvf)
critical Tenable Self-Hosted Container Security Plugin ID 473020
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code
(remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-
real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed
service path. A public-facing route accepts raw Python source and forwards it into a server-side
compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in
langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-
post_validate_code-a-real-authenticated-http-post-to-api-v1
(src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python
code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly
executes user-supplied code without sandboxing or security controls. (CVE-2026-51886)
Solution
Update the langflow library and its related packages to version 1.10.1 or later.See Also
Plugin Details
Severity: Critical
ID: 473020
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/6/2026
Updated: 10/6/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.41
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-51886
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/5/2026
Vulnerability Publication Date: 10/1/2026
Reference Information
CVE: CVE-2026-51886
cwe: CWE-94