CVE-2026-105740 | langflow-ai Langflow up to 1.8.x MCP Stdio Transport command/env os command injection

October 5, 2026 Yanac

A vulnerability has been found in langflow-ai Langflow up to 1.8.x and classified as critical. The affected element is an unknown function of the component MCP Stdio Transport. This manipulation of the argument command/env causes os command injection.

This vulnerability is registered as CVE-2026-105740. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More