A model’s output is still untrusted input

The Smart Transform component asks a language model to write a small lambda from a user instruction, then runs that lambda to filter data. Because the caller controls the instruction, they influence what the model returns. That turns the model’s output into an untrusted channel: the text about to be executed inherits the caller’s intent, not the developer’s.

TraceMint reviewed the reviewed source snapshot at Langflow 1.7.1. The generated text passed a format-only check and then went to eval, so a prompt could drive the model to emit a lambda whose body performed arbitrary operations—a prompt-injection path to remote code execution.

The component built a prompt from the instruction, called the model, and kept the reply as working text. A regular expression pulled a lambda expression out of that free-form reply. The only gate then checked that the text began with the word lambda and contained a colon—a shape assertion, not a safety one—before the string was handed to eval.

A lambda body that constructs and calls dangerous operations satisfies that same shape while doing something entirely different. Because eval executed with full builtins, the generated expression could reach imports and process operations. The consequential fact is not the model’s cleverness but the direct path from its output to the interpreter.

The later upstream change screens the generated lambda for escape gadgets before evaluating it, and evaluates it with a curated builtins mapping so names such as import, open, eval and exec are unreachable. The upstream comment describes this as defense-in-depth rather than a guaranteed sandbox. It also adds a deployment setting to block code-interpreter components where tenants should not author executable ones.

The excerpts contrast the reviewed 1.7.1 revision with the later hardening. The public commit establishes the code change; this note does not claim a causal link between the report and that change.

In the reporter-supplied local reproduction against 1.7.1, an instruction that steered the model toward an import-and-execute lambda passed the format check and reached eval, running an attacker-chosen command in the Langflow process. Practical exposure depended on who could add or run that component and on the deployment’s tenancy model. TraceMint first reported this in December 2025.

A regression review drives the component with instructions that request an import-and-execute lambda and confirms that a hardened build refuses to evaluate them. Read the reply as untrusted input and check that the safety screen and the curated builtins both apply before execution. The scenarios below are suggested review checks, not reported TraceMint test results.

For reviewers, any feature that turns generated text into behavior needs a genuine safety boundary—an allowlist, an AST check, a restricted execution environment—between the model and the interpreter, plus a separate decision about who may reach that feature at all. A format check is not that boundary.

This study analyzes immutable Langflow source revisions and a later public commit. TraceMint’s reporter record dates the first report to December 2025; that reporter-supplied date and the public code change do not, on their own, establish that this submission exclusively identified or caused the upstream change.