JVN iPedia http://jvndb.jvn.jp Advisory JVNDB-2026-010106 LangflowはAI駆動のエージェントやワークフローを構築・展開するためのツールです。バージョン1.9.0以前では、LangflowのAgentic Assistant機能は検証フェーズでLLMによって生成されたPythonコードを実行していました。このフェーズは生成されたコンポーネントコードの検証を目的としているように見えますが、実装は動的実行ポイントに到達し、生成されたクラスをサーバーサイドでインスタンス化します。攻撃者がAgentic Assistant機能にアクセスし、モデル出力を操作できる環境では、これにより任意のサーバー側Pythonコードが実行される可能性があります。この問題はバージョン1.9.0で修正されました。 cpe:/a:langflow:langflow https://jvndb.jvn.jp/ja/contents/2026/JVNDB-2026-010106.html Common Vulnerabilities and Exposures (CVE) CVE-2026-33873 https://www.cve.org/CVERecord?id=CVE-2026-33873 National Vulnerability Database (NVD) CVE-2026-33873 https://nvd.nist.gov/vuln/detail/CVE-2026-33873 GitHub Authenticated Code Execution in Agentic Assistant Validation Advisory langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/security/advisories/GHSA-v8hw-mh8c-jxfc JVNDB CWE-94 https://jvndb.jvn.jp/ja/cwe/CWE-94.html 関連文書 langflow/src/lfx/src/lfx/services/settings/auth.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/services/settings/auth.py#L71-L87 関連文書 langflow/src/lfx/src/lfx/custom/validate.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L394-L399) https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L394-L399 関連文書 langflow/src/backend/base/langflow/api/utils/core.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/api/utils/core.py#L38 関連文書 langflow/src/backend/base/langflow/api/v1/login.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/api/v1/login.py#L96-L135 関連文書 langflow/src/backend/base/langflow/agentic/services/assistant_service.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/lang https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/services/assistant_service.py#L142-L156 関連文書 langflow/src/lfx/src/lfx/custom/validate.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L441-L443) https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L441-L443 関連文書 langflow/src/backend/base/langflow/agentic/helpers/code_extraction.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/helpers/code_extraction.py#L11-L53 関連文書 langflow/src/backend/base/langflow/agentic/api/schemas.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/schemas.py#L20-L31 関連文書 langflow/src/backend/base/langflow/services/auth/utils.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/services/a https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/services/auth/utils.py#L39-L53 関連文書 langflow/src/lfx/src/lfx/custom/validate.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L241-L272) https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L241-L272 関連文書 langflow/src/backend/base/langflow/services/auth/utils.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/services/a https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/services/auth/utils.py#L156-L163 関連文書 langflow/src/backend/base/langflow/agentic/helpers/validation.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/helpers/validation.py#L27-L47 関連文書 langflow/src/backend/base/langflow/agentic/api/router.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297 関連文書 langflow/src/backend/base/langflow/agentic/services/assistant_service.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/lang https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/services/assistant_service.py#L58-L79 関連文書 langflow/src/backend/base/langflow/agentic/services/assistant_service.py at f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc langflow-ai/langflow GitHub (https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/lang https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/services/assistant_service.py#L259-L300 2026-04-06T14:43:14+09:00 2026-04-06T14:43:14+09:00