Langflow versions prior to 1.9.0: POST /api/v1/build_public_tmp/{flow_id}/flow allows unauthenticated public flow builds. When optional data parameter supplied, attacker-controlled flow data with arbitrary Python in node definitions replaces stored flow and executes via exec() with zero sandboxing.
CWE-94 code injection. Fixed in 1.9.0 by removing attacker-controllable data parameter from public build endpoint. Related media: Sysdig TRT, Aviral Bajpai original discovery writeup.
Second major Langflow RCE after CVE-2025-3248 (in CISA KEV).