langflow up to version 1.9.3 contains an issue in the Bundle URL Loader component where an attacker can craft a payload that is executed as code when the component is loaded. This flaw is a form of injection that can lead to arbitrary code execution on the host machine. The vulnerability gains its power from the way the component processes URLs, allowing a local attacker to trigger the execution path that interprets and runs the injected code.

The affected product is the langflow framework from langflow‑ai, specifically any installations running version 1.9.3 or earlier. Users running a more recent release are not impacted, and no other vendors or versions are listed as affected.

The CVSS score of 4.8 indicates a moderate severity, reflecting that the flaw requires local access and does not provide network‑based exploitation vectors. EPSS data is not available, so the likelihood of widespread immediate exploitation cannot be quantified, and the vulnerability is not present in the CISA KEV catalog. Because the attack is local, a threat actor would need physical or compromised account access to the system hosting langflow. In the absence of an official patch, the risk remains contingent on the exposure of the vulnerable component and the security controls around the deployment environment.