-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe core vulnerability exists in two layers: 1) The API endpoint handler (post_validate_code) lacked authentication, allowing unauthorized access. 2) The validation logic (validate_code) used unsafe exec() with user-controlled input. The patches add auth to the endpoint but don't modify the underlying code execution mechanism, indicating validate_code remains the injection point when called without proper auth checks. Both functions would appear in exploitation stack traces - the endpoint handler from HTTP request processing, and validate_code during code execution.
langflow.api.v1.validate.post_validate_codesrc/backend/base/langflow/api/v1/validate.py
langflow.utils.validate.validate_codesrc/backend/base/langflow/utils/validate.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langflow | pip | < 1.3.0 | 1.3.0 |