GHSA-w794-rj3p-xv45: Langflow MCP stdio command execution

Evidence record

GitHub-reviewed disclosure updated October 9 covering CVE-2026-105697, affected Langflow components, pre-spawn command handling and the incomplete 1.9.0 fix.

Read the original source ↗

Claim-level citations (5)

• supportsLangflow MCP server settings could execute commands on the host: The version 1.9.0 REST-model validation did not validate executable commands embedded in flow configurations or tweaks; the advisory says 1.10.3 applies validation at the execution sink and removes bash -c.

  Description, fixed in two steps; release-state table for 1.9.0-1.10.2 and 1.10.3+

• supportsLangflow MCP server settings could execute commands on the host: The advisory marks langflow versions 1.1.2 through 1.10.2, langflow-base versions 0.1.2 through 0.10.2 and lfx versions before 1.10.3 as affected, with the listed component-specific patched versions.

  Package, Affected versions, Patched versions table

• supportsLangflow MCP server settings could execute commands on the host: The Langflow advisory documents that MCP stdio server configurations could launch user-supplied commands and arguments on the Langflow host as the application process user when a client attempted to connect.

  Description, Summary: command/args, host execution and MCP connection paragraphs

• supportsLangflow MCP server settings could execute commands on the host: The Langflow advisory states that the 1.10.3 command allowlist still permits npx and uvx to invoke arbitrary packages by default, and recommends LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES plus interpreter and Docker hardening for multi-tenant deployments. This is an additional supply-chain exposure consideration, distinct from the fixed shell command injection.

  GitHub Advisory GHSA-w794-rj3p-xv45, Hardening recommendations for 1.10.3+, npx/uvx package allowlist and related environment variables

• supportsLangflow MCP server settings could execute commands on the host: The disclosed remote attack path depended on MCP configuration access; the advisory says exposed development instances with LANGFLOW_AUTO_LOGIN enabled could issue a token without normal login, while otherwise an authenticated non-admin user was required.

  Description, Summary: LANGFLOW_AUTO_LOGIN=true paragraph