Langflow, a platform for building and deploying AI agents, contained an OS command injection flaw: the MCP stdio transport executed any command supplied in an MCP server configuration with no allowlist. When a user added or modified a server via the API, or constructed a flow with the MCP Tools component, the configured command ran automatically on the host as the Langflow process user. This arbitrary‑command capability directly enables remote code execution, allowing scripts such as reverse shells, file deletion, or other destructive actions. The vulnerability is therefore a classic RCE that can compromise confidentiality, integrity, and availability of the host system.

The flaw existed in all Langflow releases prior to 1.10.3, in langflow‑base prior to 0.10.3, and in lfx prior to 1.10.3. Victims include any instance running the default configuration with LANGFLOW_AUTO_LOGIN=true, which automatically issues an access token via GET /api/v1/auto_login. When auto‑login is disabled, the issue still affects authenticated users, meaning every non‑admin or privileged user could exploit the vulnerability by creating or editing MCP server entries or building a flow that uses the MCP Tools component.

The CVSS score of 9.9 classifies this as critical. The EPSS score is not available, but the lack of protection in the default configuration and the ability to reach the API without credentials make exploitation highly likely. The vulnerability is not listed in the CISA KEV catalog yet, but the severity and ease of exploitation raise immediate concern. Attackers can exploit the flaw via HTTP API calls to /api/v2/mcp/servers/{server_name} or flow creation endpoints, running arbitrary commands as the Langflow process user. If the host grants broad permissions, the impact can extend to system compromise or data loss.