CVE-2026-17633: Authenticated RCE in Langflow OSS via /api/v1/custom_component

Langflow OSS 1.0.0–1.10.3 contains CVE-2026-17633 (CVSS 8.5), an authenticated RCE reachable through the /api/v1/custom_component endpoint. The flaw is in prepare_global_scope(): code inside a class body executes during exec(), and the scan_code_security() scanner is never called on this path. Fixed in 1.10.4.

• CVSS 8.5, CWE-94, affects Langflow OSS 1.0.0–1.10.3
• Requires any authenticated user plus LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true
• Payload in a class body runs at exec(); scanner is never invoked
• Fix: upgrade to Langflow 1.10.4+ with content validation