CVE-2026-105697: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in langflow-ai langflow

Langflow versions before 1.10.3 contain an OS command injection vulnerability (CWE-78) in the MCP stdio transport feature. The MCP server configuration accepts arbitrary commands from users without validation or allowlisting, executing them on the Langflow host as the Langflow process user. This occurs when Langflow attempts to connect to the configured MCP server, including during server listing, tool loading, or flow execution. The default LANGFLOW_AUTO_LOGIN=true setting allows unauthenticated attackers to obtain tokens and exploit this remotely. The vulnerability is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

Successful exploitation allows an attacker with access to MCP server settings or the MCP Tools component to execute arbitrary OS commands on the Langflow host with the privileges of the Langflow process user. This can lead to full system compromise, including data loss, system disruption, or remote code execution. The default auto-login setting exacerbates risk by allowing unauthenticated exploitation on exposed instances.

This vulnerability is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3. Users should upgrade to these versions or later. Additionally, disable the LANGFLOW_AUTO_LOGIN setting in production environments to prevent unauthenticated access. Restrict access to MCP server settings and the MCP Tools component to trusted users only.