CVE-2026-101861

Executive Summary

CVE-2026-101861 is an unsafe eval() vulnerability (CWE-94) in Langflow's schema.py affecting versions 1.0.16 through before 1.12.0, as well as 0.0.94 through before 1.12.0. An authenticated attacker can place a Python object with a malicious __repr__ method into component input options lists, and the eval() sink is triggered when a component is converted into a LangChain tool via ComponentToolkit.get_tools(), including during custom component saves through the API, by interpolating options into a Literal type string passed directly to eval(). The impact is code execution with low confidentiality, integrity, and availability effects (CVSS 4.1), requiring high attack complexity and high privileges.

Technical Analysis

CVE-2026-101861 is classified under CWE-94 (Improper Control of Generation of Code, i.e., "Code Injection"). The core defect resides in schema.py within the Langflow codebase. At fault is a pattern where component input options are interpolated into a string representing a Literal type, and that resulting string is passed directly to Python's eval() without safe evaluation controls.

Python's eval() executes arbitrary expressions in the current process context. When an attacker can influence the string passed to it, they can achieve code execution. In this case, the injected object is not merely a string — the attacker places a Python object whose __repr__ method is malicious into a component's input options list. During the conversion of the options list into a Literal type string, Python invokes repr() on each option. If an option's __repr__ has side effects, those side effects execute before or during the eval() call. This is a classic "eval injection via repr" pattern: because eval() is called on a string that includes unescaped/untrusted representation of an object, the object's own __repr__ logic becomes attacker-controlled code.

The trigger path is not merely the raw eval call. Per the NVD description, the sink is reached when a component is converted into a LangChain tool via ComponentToolkit.get_tools(). This conversion path is also exercised during custom component saves through the API. The API-driven custom component save is significant because it provides an authenticated, programmatic route to submit a malicious component definition that will later be converted into a tool, thereby firing the eval() sink. The privilege requirement (PR:H) indicates that an attacker must already possess high-privilege authenticated access — likely the ability to create or save custom components — before this exploit is reachable.

Hard constraints on this analysis: the NVD description does not enumerate function signatures beyond schema.py, ComponentToolkit.get_tools(), and the Literal type string interpolation. No URL endpoints, parameter names, or additional file paths are provided. No public proof-of-concept, Nuclei template, or exploit code exists in the data provided. The exact API route used to save custom components is not specified in the source data and is therefore not asserted here.

Because the sink is eval(), the vulnerability class is code injection with a Python-object side effect mechanism. The __repr__ method is invoked by Python itself during string formatting, so even "safe" string interpolation can trigger attacker code. The subsequent eval() then parses the resulting string in a context where a crafted representation can introduce executable expressions.

Exploitation Scenarios

Note: No public PoC is available for CVE-2026-101861. The attack chain below is inferred strictly from the vulnerability class (CWE-94 eval injection) and the mechanism described in the NVD description. No function names, endpoints, or parameters beyond those in the description are invented.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed or internal Langflow instance running an affected version (1.0.16 before 1.12.0 or 0.0.94 before 1.12.0). Because authentication is required and high privileges are needed (PR:H), reconnaissance focuses on obtaining or abusing an authenticated high-privilege account with permission to save custom components.

2. Triggering the flaw class. With authenticated access, the attacker crafts a custom component whose input options list contains a Python object with a malicious __repr__ method. When that component is converted into a LangChain tool via ComponentToolkit.get_tools() — or when a custom component is saved through the API, which exercises the same conversion path — the options are interpolated into a Literal type string. Python calls repr() on the malicious object during this interpolation, executing attacker-controlled logic. The resulting string is then passed to eval() without safe evaluation controls, allowing the injected expression to run in the application's Python process.

3. Payload / execution at the vulnerability-class level. The execution primitive is Python's eval() operating on a string that includes the attacker-supplied object representation. Depending on how the __repr__ output is formatted and how the surrounding Literal string is built, the attacker can attempt to break out of the intended literal context and introduce an arbitrary expression. Because eval() has full access to builtins and the surrounding scope, successful injection yields code execution as the user running the Langflow service.

4. Post-exploitation impact. Given the CVSS scope of unchanged and low C/I/A, the immediate confirmed impact is code execution with limited effects on confidentiality, integrity, and availability. In practice, arbitrary code execution in a Langflow server can be leveraged to read environment variables and secrets, modify application data, persist within the host or container, and pivot to connected LLM providers, vector stores, or databases. The high attack complexity (AC:H) reflects the need to craft a working object representation and navigate the conversion path; the high privilege requirement (PR:H) limits this to already-compromised or highly trusted accounts.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L, giving a base score of 4.1 (Medium). Network reachability (AV:N) means the vulnerable Langflow service is exploitable over the network rather than requiring local access. High attack complexity (AC:H) indicates that successful exploitation depends on conditions outside the attacker's direct control, such as crafting a correctly formed object representation and reaching the conversion path. High privileges required (PR:H) substantially narrow the threat to authenticated users who can save or manage custom components. No user interaction (UI:N) is needed. Scope is unchanged (S:U), so the vulnerable component and impacted component are the same. Confidentiality, integrity, and availability impacts are each rated Low (C:L/I:L/A:L).

Business impact centers on Langflow deployments that allow less-trusted or delegated authenticated users to create or save custom components. Where such access exists, a lower-trust insider or a compromised high-privilege account can escalate to code execution on the Langflow server. Because Langflow orchestrates LLM workflows, a compromised instance can expose API keys for model providers, prompt and conversation data, and connected data stores. Blast radius is limited by the PR:H and C:L/I:L/A:L constraints but the strategic value of LLM orchestration servers makes even low-rated code execution operationally significant. Public exposure of Langflow management interfaces should be treated as high risk because it removes the network barrier and leaves only authentication as the control.

Detection Guidance

Sigma Rule

title: Langflow Unsafe eval Code Injection Attempt (CVE-2026-101861)
id: 7f3c9a21-4b6d-4e8a-9c11-2d8f0a5b6c47
status: experimental
description: Detects attempts to abuse unsafe eval in Langflow schema.py via malicious __repr__ objects in component input options.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101861
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: langflow
detection:
  selection_eval:
    message|contains:
      - 'ComponentToolkit.get_tools'
      - 'eval('
  selection_repr:
    message|contains:
      - '__repr__'
      - 'Literal['
  selection_options:
    message|contains:
      - 'options'
      - 'custom component'
  condition: (selection_eval and selection_repr) or (selection_eval and selection_options)
falsepositives:
  - Legitimate component development and debugging
  - Internal reflection or serialization of object options
level: high

YARA Rule

rule CVE_2026_101861_Langflow_Eval_Injection
{
    meta:
        description = "Detects malicious Langflow component definitions abusing __repr__ in input options for eval injection"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101861"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "ComponentToolkit" ascii wide
        $s2 = "get_tools" ascii wide
        $s3 = "__repr__" ascii wide
        $s4 = "eval(" ascii wide
        $s5 = "Literal[" ascii wide
        $s6 = "input_types" ascii wide
        $s7 = "options" ascii wide

    condition:
        filesize < 2MB and
        (($s1 and $s3) or ($s3 and $s4)) and
        ($s5 or $s6 or $s7)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101861 Langflow Component Save eval Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"component"; nocase; http.request_body; content:"__repr__"; nocase; http.request_body; content:"Literal["; nocase; classtype:attempted-admin; sid:2026101861; rev:1; reference:cve,2026-101861; metadata:affected_product Langflow;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name == "python" and process.args : "*langflow*"]
  [network where destination.port in (80, 443, 7860, 3000) and event.action == "connection_attempted"]

Splunk SPL Query

index=langflow OR index=app_logs sourcetype=langflow*
| search ("ComponentToolkit.get_tools" OR "eval(" OR "Literal[") AND ("__repr__" OR "options")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by host, user, src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="langflow,cve-2026-101861,">
  <rule id="101861" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">ComponentToolkit.get_tools|eval\(|__repr__|Literal\[</field>
    <description>CVE-2026-101861: Potential Langflow unsafe eval code injection via malicious __repr__ object in component options.</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>code_execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict access to the Langflow management interface and API to trusted networks only; do not expose the service directly to the internet.
• Enforce least privilege on Langflow accounts. Because exploitation requires high privileges (PR:H), reduce the number of accounts able to create or save custom components.
• Disable or tightly gate custom component creation/saving for untrusted or delegated users until a fix is available.
• Review existing custom components and component input options for suspicious Python objects or __repr__ definitions that could be attacker-controlled.
• Monitor logs for ComponentToolkit.get_tools, unexpected eval() usage, and suspicious Literalschem/Literal[ interpolations.

2. Patch / upgrade steps

• No vendor patch has been confirmed by any tracked source. The affected ranges are 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0.
• Track the Langflow project (GitHub releases and security advisories) for a fix in or after 1.12.0.
• When an official release containing the fix becomes available, upgrade immediately and verify the schema.py evaluation path no longer passes untrusted options into eval().
• Until then, apply compensating controls above rather than relying on an unavailable patch.

3. Long-term hardening

• Replace eval() usage with ast.literal_eval() or a strictly parsed allowlist for Literal type construction so object representations cannot execute code.
• Sanitize and type-check all component input options before they are interpolated into type strings.
• Implement server-side validation of custom component definitions with an allowlist of permitted option types.
• Run Langflow in a container with minimal privileges, no host mounts, and restricted network egress.
• Adopt a secure SDLC review gate for any use of eval()/exec() and add SAST rules to flag the pattern.
• Log and alert on changes to custom components, and integrate the detection rules above into the SOC.

References

• NVD — CVE-2026-101861: https://nvd.nist.gov/vuln/detail/CVE-2026-101861
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• Langflow project releases and security advisories: https://github.com/langflow-ai/langflow/releases
• FIRST EPSS: Not yet scored (no EPSS value available at time of writing); CISA KEV: Not listed. No exploit-in-the-wild evidence or known threat actor campaign has been observed in the data provided.