MCP command injection vulnerability CVE-2026-105740 before Langflow 1.9.0 can lead to RCE

Langflow versions before 1.9.0 have an OS command injection vulnerability CVE-2026-105740, with a CVSS score of 9.9 and a public PoC available. Any authenticated user can achieve remote code execution by adding an MCP server using the Stdio transport; the user-supplied command field is passed directly to bash -c for execution, with no validation, no whitelist, and no sandbox, and it executes immediately when fetching the server list; the env field also allows injecting arbitrary environment variables such as LD_PRELOAD and PATH overrides. The vulnerability is fixed in 1.9.0, and EPSS gives a 0.59% probability of exploitation within 30 days; it is currently not listed in the CISA KEV catalog.