Langflow's Smart Transform agent component lets prompt-injected text trigger arbitrary code execution

Undisclosed·Langflow Smart Transform (LambdaFilterComponent)Fixed

Langflow's Smart Transform component feeds flow-author instructions and a preview of input data into an LLM prompt asking it to write a one-line Python lambda, then runs the model's output through eval() after only checking that the string starts with 'lambda' and contains ':' — letting injected instructions produce payloads like `lambda x: __import__("os").system("id")` that execute with the privileges of the Langflow server process. The same disclosure batch also reported that Langflow derives the Fernet key used to encrypt every stored credential (LLM API keys, DB passwords, OAuth tokens) by seeding Python's non-cryptographic `random` module with the instance's SECRET_KEY, so anyone who obtains that key file can decrypt all stored secrets offline with no brute force.

Blast radius

All self-hosted and multi-tenant Langflow deployments on versions 1.3.0–1.10.2 were exposed to the Smart Transform code-execution path, and versions <=1.10.0 to the weak-key issue; no specific victim organisation or exploitation-in-the-wild is named in the advisories. Chained with Langflow's separately disclosed MCP path-traversal bug, the weak-key flaw lets a single low-privileged account decrypt every OpenAI/Anthropic key, database credential and webhook secret stored by every user on an instance, and the Smart Transform bug gives an attacker full code execution inside the Langflow service itself; actual real-world exploitation is not disclosed.

Root cause

Smart Transform converts an LLM-generated string directly into executable Python via eval() after only a superficial format check instead of sandboxing or AST-validating the generated code, and the credential store derives its encryption key with a non-cryptographic PRNG (or uses the raw secret as the key) instead of a proper KDF.

How it was caught

Not caught in production use — found by external security researchers (credited: Peyton Kennedy of Endor Labs plus four independent duplicate reporters) who responsibly disclosed the chain to GitHub/Langflow rather than it surfacing from an operator noticing an attack.

What changed

Smart Transform now validates the generated code's AST and evaluates it with a restricted builtins mapping (PR #13530 / backport PR #14071, shipped in Langflow 1.10.3 and 1.11.0); the Fernet key derivation was replaced with SHA-256 hashing, with backward-compatible legacy decryption for old ciphertext (PR #13704, shipped in 1.10.1).

Take-awayNever eval() or exec() LLM-generated code against full builtins even after a 'looks safe' string check — sandbox or AST-restrict anything an agent writes before running it, and never seed a non-cryptographic PRNG with a secret to derive an encryption key.