Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.

Details

The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py).

The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:

# src/lfx/src/lfx/custom/validate.py
if isinstance(node, ast.FunctionDef):
    code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
    # ...
    # exec_globals creates a restricted-looking scope, but standard builtins are available
    exec(code_obj, exec_globals)

By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.

Affected Versions

• /api/v1/validate/code had no authentication at all until commit 3fed9fe1b5 ("fix: Add authentication to various endpoints", #10977), first released in v1.7.2. Before that release, this same exec() sink was reachable unauthenticated.
• From v1.7.2 through v1.10.0, the endpoint required a valid session but the exec() sink was untouched, so any authenticated user (or any user at all under ) could trigger RCE via a malicious decorator as described below.