CRITICAL LANGFLOW RCE FLAW EXPLOITED TO HACK AI APP SERVERS

Summary from the TLDR InfoSec newsletter

Langflow offers a visual programming tool for building LLM-powered workflows using LangChain components. An unauthenticated RCE vulnerability where Langflow's /api/v1/validate/code endpoint, which is designed to validate user-submitted code, runs any code with no sandboxing or sanitization. CISA has now reported that this vulnerability is being actively exploited and has given federal agencies until May 26 to upgrade the software or add mitigations such as placing the software behind a firewall.