The vulnerability is a code injection flaw that allows any authenticated user to submit raw Python code to a public API endpoint. The supplied code is compiled and executed on the server without any sandboxing or input validation, giving the attacker full control over the host. Because the vulnerability results in arbitrary code execution, the attacker can modify any file, exfiltrate data, install malware, and effectively take over the system and its network.

The flaw resides in langflow‑ai’s Langflow v1.9.3. All installations of this version or earlier that expose the /api/v1/validate/code endpoint are affected. Users of older releases containing the same unpatched code path share the same risk.

The attack vector is an HTTP or browser‑based request to the validate endpoint. An authenticated user can craft a request that includes malicious Python, which is then executed server‑side. No known public exploits have been observed and the EPSS score is <1%, but because the exploit requires only local authentication, the risk of compromise remains high. The vulnerability is not listed in CISA KEV, but its impact warrants immediate attention.