{"uuid": "a6c6f7d8-7ad6-41bf-aa97-e17c19e54d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-w794-rj3p-xv45", "type": "seen", "source": "https://gist.github.com/alon710/6614304235c0dc126039860ab423b97a", "content": "# CVE-2026-105697: CVE-2026-105697: OS Command Injection in Langflow Model Context Protocol Integration\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105697\n\n## Summary\nA critical OS command injection vulnerability exists in Langflow's Model Context Protocol (MCP) server integration using stdio transport, allowing unauthenticated remote command execution under default configurations.\n\n## TL;DR\nLangflow versions prior to 1.10.3 allowed unauthenticated remote attackers to execute arbitrary shell commands on the hosting system by exploiting a model context protocol (MCP) server integration wrapper that parsed commands inside a shell context.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 9.9 (Critical)\n- **EPSS Score**: 0.00396\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- langflow\n- langflow-base\n- lfx\n- **langflow**: >= 1.1.2, < 1.10.3 (Fixed in: `1.10.3`)\n- **langflow-base**: >= 0.1.2, < 0.10.3 (Fixed in: `0.10.3`)\n- **lfx**: < 1.10.3 (Fixed in: `1.10.3`)\n\n## Mitigation\n\n- Upgrade Langflow, langflow-base, and lfx to secure versions (>= 1.10.3 / >= 0.10.3)\n- Disable the development auto-login feature in production environments\n- Apply strict network firewall policies to restrict public access to port 7860\n\n**Remediation Steps:**\n1. Step 1: Terminate current insecure Langflow container or system processes.\n2. Step 2: Update the requirement files or container images to target version 1.10.3.\n3. Step 3: Modify configuration settings, ensuring the environment variable LANGFLOW_AUTO_LOGIN is explicitly configured to false.\n4. Step 4: Restart the service and verify that the endpoint /api/v1/auto_login no longer issues authorization tokens without authentication.\n\n## References\n\n- [GitHub Security Advisory GHSA-w794-rj3p-xv45](https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45)\n- [NVD Record for CVE-2026-105697](https://nvd.nist.gov/vuln/detail/CVE-2026-105697)\n- [Authoritative CVE Project Entry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105697.json)\n- [Langflow Release v1.10.3](https://github.com/langflow-ai/langflow/releases/tag/v1.10.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105697) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T11:30:28.000000Z"}