504f760989
* fix(security): block code injection via the Tweaks API (CWE-94)
apply_tweaks() only refused to override the field literally named "code", but
code-execution components expose their executable input under other names
(python_code, script, ...). An authenticated user could inject arbitrary Python
through POST /api/v1/run/{flow_id} tweaks (e.g. setting python_code on a Python
Interpreter node), achieving RCE.
Block tweaks by field type ("code") and by code-execution component type
(CODE_EXECUTION_COMPONENT_TYPES) instead of a single field-name blacklist.
Applied to both the langflow and lfx copies of apply_tweaks.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(security): scope Tweaks code-field block to code/sandbox inputs
Addresses review on PR #13705. The blanket "block every field on a
code-execution component" guard over-blocked benign inputs (name,
description, data, sample_size) and mislabeled them as code in the log.
Scope the block to the actual code-bearing fields: a tweak is refused when
the field is type "code", literally named "code", or is a code/sandbox input
of a code-execution component. The executable inputs (python_code, tool_code,
filter_instruction) serialize as plain "str", so the field-type=="code" guard
alone would re-open the CWE-94 bypass — they are blocked by name via the new
CODE_EXECUTION_FIELD_NAMES set, kept beside CODE_EXECUTION_COMPONENT_TYPES so
the two consumers stay in sync. global_imports stays blocked (it is the
import allow-list feeding the exec() namespace / documented sandbox boundary).
Also: name the offending field in the warning, drop the always-true
`if tweak_name in template_data` and de-indent, and add the missing lfx
regression suite (src/lfx/tests/unit/test_process.py) so the two apply_tweaks
copies cannot drift.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test(security): tripwire so code-exec types must register their code fields
Addresses PR review: the sync between CODE_EXECUTION_COMPONENT_TYPES and
CODE_EXECUTION_FIELD_NAMES was comment-only, so adding a fifth code-execution
component and registering its type without its code field would silently drop
the by-name half of the Tweaks guard for that component.
The component classes aren't importable in the lfx unit env (optional deps),
so introspection isn't viable. Instead add a self-contained checksum test that
forces the next person to keep the two sets in lockstep:
- test_every_code_execution_type_has_registered_code_fields: every type in
CODE_EXECUTION_COMPONENT_TYPES must have a registry entry, and each entry's
fields must be covered by CODE_EXECUTION_FIELD_NAMES (or the globally-blocked
"code"). Adding a type without its code field fails the suite.
- test_no_unclaimed_code_execution_field_names: catches stale frozenset entries
left behind after a component is removed/renamed.
Point the flow_validation.py comment at the new guard test by name.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Langflow is a powerful platform for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Langflow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools.
✨ Highlight features
- Visual builder interface to quickly get started and iterate.
- Source code access lets you customize any component using Python.
- Interactive playground to immediately test and refine your flows with step-by-step control.
- Multi-agent orchestration with conversation management and retrieval.
- Deploy as an API or export as JSON for Python apps.
- Deploy as an MCP server and turn your flows into tools for MCP clients.
- Observability with LangSmith, LangFuse and other integrations.
- Enterprise-ready security and scalability.
🖥️ Langflow Desktop
Langflow Desktop is the easiest way to get started with Langflow. All dependencies are included, so you don't need to manage Python environments or install packages manually. Available for Windows and macOS.
⚡️ Quickstart
Install locally (recommended)
Requires Python 3.10–3.14 and uv (recommended package manager).
Install
From a fresh directory, run:
uv pip install langflow -U
The latest Langflow package is installed. For more information, see Install and run the Langflow OSS Python package.
Run
To start Langflow, run:
uv run langflow run
Langflow starts at http://127.0.0.1:7860.
That's it! You're ready to build with Langflow! 🎉
📦 Other install options
Run from source
If you've cloned this repository and want to contribute, run this command from the repository root:
make run_cli
For more information, see DEVELOPMENT.md.
Docker
Start a Langflow container with default settings:
docker run -p 7860:7860 langflowai/langflow:latest
Langflow is available at http://localhost:7860/. For configuration options, see the Docker deployment guide.
🛡️ Security
For security information, see our Security Policy.
🚀 Deployment
Langflow is completely open source and you can deploy it to all major deployment clouds. To learn how to deploy Langflow, see our Langflow deployment guides.
⭐ Stay up-to-date
Star Langflow on GitHub to be instantly notified of new releases.
👋 Contribute
We welcome contributions from developers of all levels. If you'd like to contribute, please check our contributing guidelines and help make Langflow more accessible.