Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Fix availableCritical · CVSS 9.9EPSS 0.47%

Published Oct 7, 2026 · updated Oct 9, 2026

What to do

  1. Upgrade to a fixed version: langflow 1.10.3, langflow-base 0.10.3, lfx 1.10.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIlangflow

Vulnerable versions
>= 1.1.2, < 1.10.3
Fixed in
1.10.3

Check your project: pip show langflow

PyPIlangflow-base

Vulnerable versions
>= 0.1.2, < 0.10.3
Fixed in
0.10.3

Check your project: pip show langflow-base

PyPIlfx

Vulnerable versions
< 1.10.3
Fixed in
1.10.3

Check your project: pip show lfx

Sources

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

← All critical vulnerabilities