Langflow MCP stdio Launcher Environment Variable Injection RCE

Technical Analysis

Langflow spawns MCP (Model Context Protocol) tool servers via a stdio launcher that passes environment variables to child shell processes. The DANGEROUS_ENV_VARS blocklist in util.py omits SHELLOPTS, BASHOPTS, and PS4, all of which can trigger arbitrary command execution when a shell interprets them (e.g., PS4 is evaluated during xtrace, and SHELLOPTS/BASHOPTS can enable dangerous bash options). An unauthenticated attacker who can influence the environment passed to the MCP launcher (e.g., via a crafted flow, tool config, or exposed API) can inject one of these variables to execute arbitrary code in the context of the Langflow server process. This crosses the trust boundary between the agent orchestration layer and the underlying OS shell, effectively turning a tool-launch mechanism into a full remote code execution primitive without requiring authentication.

Affected Systems

Langflow (IBM Langflow OSS 1.0.0-1.10.1); protocols: MCP

Detection Signatures

• Environment variables SHELLOPTS, BASHOPTS, or PS4 present in requests/configs passed to Langflow MCP launcher
• Unexpected child process spawned by Langflow with anomalous env vars
• Log entries showing MCP stdio server launches with non-standard env keys
• Outbound connections or shell command execution immediately following Langflow API/flow submission
• Monitor src/lfx/src/lfx/base/mcp/util.py invocation paths for env passthrough

Remediation Steps

1. 1

   Upgrade Langflow

   Apply the vendor patch/upgrade beyond version 1.10.1 once available; track IBM/Langflow security advisories for the fixed release.

2. 2

   Expand dangerous env var blocklist

   Manually patch DANGEROUS_ENV_VARS to include SHELLOPTS, BASHOPTS, PS4, and other shell-behavior-modifying variables (e.g., ENV, BASH_ENV) until an official fix is deployed.

3. 3

   Restrict MCP launcher input

   Sanitize or allowlist environment variables passed to any subprocess/stdio launcher; never pass user-controlled key-value pairs directly into process environments.

4. 4

   Network and access controls

   Restrict access to Langflow instances behind authentication and network segmentation; do not expose MCP-enabled Langflow deployments directly to the internet.

5. 5

   Runtime monitoring

   Deploy process and syscall monitoring around Langflow's MCP launcher to detect anomalous shell invocations or unexpected child processes.