# Langflow Untrusted Functionality Inclusion RCE Payload Execution

- **Severity:** High
- **Signature ID:** `7c3f5a1e-9b42-4d7a-8f16-2b5d0e9a4c31`
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** LLM05 (Improper Output Handling)

## Summary

Langflow, an AI workflow builder, can be made to evaluate code supplied by a remote attacker without any login. When exploited, the Langflow backend process spawns a child process to run that code, which is the moment this detection catches.

## How the attack works

An unauthenticated attacker sends a request to a public-facing Langflow instance that exploits its handling of untrusted 'functionality inclusion' (loading and running code from a source it should not trust). Langflow evaluates the attacker-supplied code and, in doing so, spawns a child process from the Langflow runtime. That child process command line contains a download-and-execute step, an inline interpreter call, or a reverse-shell primitive. The detection looks for this combination: a process clearly launched by Langflow (install path, module invocation, environment variables, or its uvicorn/gunicorn worker) whose command line also carries one of these execution patterns, while excluding known legitimate Langflow build, test, and dependency-install activity.

## Why it matters

A successful exploit gives a remote attacker code execution on the server hosting Langflow, with whatever privileges the Langflow process runs under. This can lead to further compromise of the host, theft of data or credentials accessible to that server, or use of the machine as a foothold into the rest of the network.

## What you can do

- Do not expose Langflow directly to the internet; place it behind authentication and a restrictive network boundary.
- Run Langflow under a low-privilege service account and restrict its filesystem and network access so a compromised worker cannot reach sensitive systems.
- Review Langflow server logs for child processes that download files, invoke interpreters inline, or open outbound shells shortly after inbound requests.
- Keep Langflow patched to the latest release and monitor vendor advisories for fixes related to untrusted code/component loading.

## Known benign look-alikes

- Langflow custom-component development that installs dependencies at runtime inside the Langflow venv (pip/uv/poetry) — suppressed by filter_package_tooling.
- Langflow build and packaging subprocesses that shell out to `python -c "import setuptools; ..."` or read pyproject.toml — suppressed by filter_package_tooling and filter_version_probe.
- CI jobs running the Langflow test suite, linters, or alembic migrations, which spawn interpreters with -c/-e — suppressed by filter_dev_tooling.
- Interpreter or toolchain version probes emitted by the Langflow entrypoint on startup — suppressed by filter_version_probe.
- A legitimate Langflow data-loader or API component that intentionally shells out to curl/wget against an approved corporate endpoint; this is a genuine residual FP and is why the rule reports rather than blocks.
- Container entrypoints wrapping startup as `sh -c "langflow run ..."` — these do not match any execution primitive unless a download/interpreter token is also present.

## References

- https://cwe.mitre.org/data/definitions/829.html
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1059/
- https://atlas.mitre.org/techniques/AML.T0049

---
Source: https://www.netzilo.com/threats/langflow-untrusted-functionality-rce