-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langflow | pip | <= 1.0.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the PythonCodeTool's build method directly executing user-controlled code via exec() in the global namespace. The GitHub issue reproduction demonstrates how passing malicious code in tool_code (like os.popen calls) gets executed server-side. The lack of input validation, restricted namespaces, or sandboxing around the exec() call makes this a clear RCE vector. The code structure shown in the issue matches typical Python tool execution patterns in LangChain-based frameworks.