langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Affected: PyPI: langflow

###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The` /api/v1/validate/code` endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.

### Details The vulnerability is located in `src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py`).

The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:

``` # src/lfx/src/lfx/custom/validate.py if isinstance(node, ast.FunctionDef): code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec") # ... # exec_globals creates a restricted-looking scope, but standard builtins are available exec(code_obj, exec_globals) ```

By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.

### Affected Versions

- **`/api/v1/validate/code` had no authentic…