Langflow PythonREPLComponent not sandboxed leads to RCE
Start here
A Langflow security advisory reports that its Python execution component, PythonREPLComponent, lacks effective isolation. In affected deployments, authenticated users with permission to edit and run flows could exploit this to gain service process privileges and there is a privilege escalation risk. The advisory lists the affected range as versions before 1.10.1 of Langflow and the underlying lfx package.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- GitHub 安全公告SelectedLangflow fixes authenticated RCE and privilege escalation vulnerability caused by PythonREPLComponent not being sandboxed
Langflow security advisory reports that its Python execution component lacks effective isolation; in affected deployments, authenticated users with permission to edit and run flows may gain service process privileges, with a privilege escalation risk. The advisory lists affected versions as before 1.10.1 for Langflow and the underlying lfx package.
Related discussion
Attention trend
New sources per day
- Oct 6: 1 new sources (1 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)