Langflow OS command injection via MCP stdio server configuration

What's on the official record

The OSV advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697) reports a CRITICAL OS command injection (CWE-78) in the PyPI package langflow, fixed in version 1.10.3. The advisory is dated 7 October 2026. Before 1.10.3, the MCP stdio transport launched whatever command and arguments a user put in an MCP server configuration, with no allowlist and wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings could configure it.

Assessment

For a platform or AI-stack owner, the record names a fixed version, 1.10.3, and a reachable configuration path through the MCP server settings. That lets you check whether any deployed langflow instance runs below 1.10.3 and whether the MCP server settings are reachable by users who should not configure them, then patch or isolate the affected instances.

For a deal team, the advisory gives you a concrete diligence item: whether a target's AI-stack deployment or product depends on langflow below 1.10.3, and whether that dependency is reachable through an MCP server configuration path. The CRITICAL severity and the named fixed version let you scope the check and price or condition a transaction on the remediation being applied.

What would change this call

A revised advisory that names additional affected versions or a different fixed version would change the patch target. A statement from the maintainers that the MCP stdio transport is disabled or unreachable by default in the affected versions would narrow the exposure the record currently describes.

What to check next

Confidence

Filed 25 October 2026 from the record dated 7 October 2026.

Sources

[1] Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration — https://github.com/advisories/GHSA-w794-rj3p-xv45