Critical RCE in Langflow build_public_tmp endpoint. Attacker sends POST with malicious data JSON containing Python in node definitions. No authentication required — endpoint designed for public shared flows.
Root cause: optional data parameter bypasses stored flow validation. Code reaches exec() unsandboxed via start_flow_build().
Remediation: upgrade to Langflow 1.9.0+. Recommended fix removes data parameter entirely — public flows execute stored definitions only.
Exploitation confirmed in wild within 20 hours (Sysdig). Rotate cloud API keys and database credentials after patching.