Listen to this Post
How CVE-2026-13435 Works
CVE-2026-13435 is a critical improper input validation vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.1. The flaw resides in the PythonREPL sandbox implementation, specifically within the Python Interpreter component (PythonREPLComponent) and the legacy Python REPL tool (PythonREPLTool). These components are designed to allow flow and agent authors to execute Python code within a restricted environment, using an operator-configured import allow-list and a curated set of safe builtins.
The root cause is a failure to properly set the `__builtins__` variable in the execution context. When Python’s `exec()` function is called without a `__builtins__` entry in the global namespace, it automatically injects the full, unrestricted `builtins` module. This means that even if an administrator configures the “Global Imports” setting to only allow safe modules like math, the execution environment still contains dangerous functions like __import__, eval, exec, compile, and open. An attacker with the ability to provide input to a deployed flow or agent can supply specially crafted Python code that bypasses the validator.
The vulnerability allows an authenticated attacker to execute arbitrary Python code outside the intended sandbox. This bypass enables the reading of sensitive values from the server’s process environment and in-memory application settings, including provider API keys, database credentials, and the symmetric signing and encryption key material used for JWT issuance and encrypting stored credentials. Under the default HS256 JWT configuration, exposure of this key material could allow the attacker to forge valid access tokens for any known user and decrypt stored encrypted credentials. The vulnerability is classified as CWE-94: Improper Control of Generation of Code (‘Code Injection’). IBM has assigned this vulnerability a CVSS base score of 9.9 (Critical).
DailyCVE Form:
Platform: Langflow OSS
Version: 1.0.0-1.10.1
Vulnerability: Code Injection
Severity: Critical (9.9)
date: 2026-07-30
Prediction: 2026-07-14
What Undercode Say:
The fix for this vulnerability involves a multi-layered hardening of the Python REPL sandbox. The core changes are implemented in a new shared module, lfx/utils/python_repl_security.py.
– Restricted Builtins: The `safe_builtins()` function provides a curated `__builtins__` allow-list. It keeps common safe builtins (e.g., len, range, container types) and removes everything that can import modules, execute/compile code, touch the filesystem, or reach interpreter internals (__import__, eval, exec, compile, open, input, globals, locals, vars, getattr, setattr, delattr, breakpoint, etc.). Setting `__builtins__` to this dict makes the import allow-list the only way to bring in modules.
– AST-based Code Validation: The `validate_code_safety()` function performs an Abstract Syntax Tree (AST) check that rejects:
– Inline `import` / `from … import` statements (modules must come from Global Imports).
– Dunder attribute access (e.g., the classic builtin-free escape ().__class__.__bases__
.__subclasses__()</code>).
- Frame / coroutine / traceback introspection (<code>gi_frame</code>, <code>f_globals</code>, <code>f_back</code>, <code>tb_frame</code>, <code>mro</code>, etc.).
- `str.format("{0.__globals__}")` template traversal (an attribute chain hidden inside a literal string).
- Execution Gate: The `ensure_code_execution_enabled()` function is added to refuse Python code execution when the global `allow_custom_components` setting is <code>False</code>. This makes the PythonREPL execution policy consistent with the custom-component policy.
Both the core and legacy components now call these security functions before any sanitization or execution takes place. The default "Global Imports" setting is also reduced from `"math,pandas"` to `"math"` to remove the `pandas.read_pickle` deserialization sink by default.
<h2 style="color: blue;">Exploit:</h2>
An attacker with valid credentials can exploit this vulnerability by crafting a Python payload that bypasses the sandbox. The following steps outline a potential exploitation path:
1. Identify a Target: Locate a Langflow OSS instance (versions 1.0.0 through 1.10.1) where the Python Interpreter or legacy Python REPL tool is accessible to an authenticated user.
2. Craft the Payload: Create a Python code string that leverages the injected `__builtins__` to execute arbitrary system commands. For example, to read the contents of the `/etc/passwd` file:
[bash]
print(open('/etc/passwd').read())
Or, to execute a system command:
import subprocess; print(subprocess.check_output(['id']))
As demonstrated, the `__import__` function is available, allowing the import of modules like `subprocess` even if they are not in the "Global Imports" allow-list.
3. Inject the Payload: Supply this code as input to a deployed flow, agent, or any permitted run path that invokes the vulnerable Python Interpreter component.
4. Achieve Code Execution: The `exec()` function, lacking a restricted `__builtins__` namespace, will execute the supplied code with full Python privileges. This allows the attacker to read sensitive environment variables, modify files, or perform other malicious actions.
Protection:
To protect against CVE-2026-13435, the following measures are recommended:
- Upgrade Langflow OSS: IBM strongly recommends upgrading to Langflow OSS version 1.10.2 or later, which contains the official fix for this vulnerability.
- Apply the Patch: If upgrading is not immediately possible, apply the patches from the relevant pull requests:
- PR 13397: Restricts builtins and validates code in Python Interpreter components.
- PR 13700: Gates PythonREPL execution on the `allow_custom_components` setting.
- Review Configuration: Ensure that the `allow_custom_components` setting is set to `false` in production environments where custom components are not required, as this will now also disable the PythonREPL execution.
- Network Segmentation: Limit network access to Langflow OSS instances to trusted users and networks to reduce the attack surface.
- Monitor Logs: Actively monitor application logs for any unusual or unauthorized Python code execution attempts.
Impact:
A successful exploitation of CVE-2026-13435 has a critical impact on the confidentiality, integrity, and availability of the affected system.
- Confidentiality Breach: An attacker can read sensitive values from the server's environment and memory, including provider API keys, database credentials, and JWT signing keys. Exposure of the JWT signing key could allow the attacker to forge valid access tokens.
- Integrity Compromise: By forging access tokens or decrypting stored credentials, an attacker could gain unauthorized access to other parts of the system, potentially modifying data or user permissions.
- System Takeover: The ability to execute arbitrary Python code ultimately allows the attacker to execute system commands with the privileges of the Langflow service process, leading to a complete compromise of the host system.
- Lateral Movement: Compromised credentials and network access could be used to launch further attacks on the internal network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
