CVE-2026-51886 describes a code injection vulnerability in langflow-ai langflow up to version 1.9.3. The vulnerability exists in the validate-post_validate_code function located in src/backend/base/langflow/api/v1/validate.py. The affected endpoint, /api/v1/validate/code, accepts raw Python source code via an authenticated HTTP POST request and executes it directly on the server without any entitlement checks or sandboxing. This flaw enables an authenticated attacker to execute arbitrary Python code remotely on the server.

Successful exploitation allows an authenticated attacker to execute arbitrary Python code on the server, potentially leading to full compromise of the server environment. This can result in unauthorized access, data theft, service disruption, or further lateral movement within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/v1/validate/code endpoint to trusted users only and consider disabling this functionality if not required. Monitor for suspicious authenticated activity targeting this endpoint.