MCP STDIO command injection: Langflow remediation and Fay exposure

What it is

Status as of 25 October 2026. Re-check the Langflow advisory's affected-package table and Fay's CVE record for remediation updates. The Langflow advisory published on 28 September 2026 identifies CVE-2026-105697: untrusted MCP STDIO configuration can cause operating-system commands to run with the application's privileges. Treat the launch configuration as executable code, including its arguments and environment.

The vendor lists langflow >= 1.1.2, < 1.10.3, langflow-base >= 0.1.2, < 0.10.3, and lfx < 1.10.3 as affected. Their respective patched versions are 1.10.3, 0.10.3, and 1.10.3. The earlier Langflow 1.9.0 change validated the settings API; the complete fix also validates flow-supplied configuration immediately before process creation and removes the shell wrapper. Vendor advisory.

CVE-2026-30618 separately identifies unsafe MCP STDIO management in Fay 4.3.1. The reviewed record gives no fixed version or broader affected range. CVE Program record.

Why it matters

CWE-78 includes both unsafe construction of command arguments and letting untrusted input select the executable itself. Removing shell interpretation addresses only part of that problem. An interpreter or package launcher can still execute code that its caller supplies. A process should have no more filesystem or network authority than its assigned task needs. CWE-78.

The Langflow advisory warns that execution can precede a failed MCP connection. Therefore, a startup error does not establish that nothing ran. Investigate unexpected process creation or configuration changes as possible exposure; these signs are not unique indicators of this CVE.

How to apply

• Inventory the deployed environment. In an environment that is still trusted, run python3 -m pip show langflow langflow-base lfx; compare the reported packages with the advisory, including dependencies inside the deployed image. This command displays installed package metadata. pip show.
• For Langflow, deploy a supported release containing the complete fix. Repeat the package inventory and review saved MCP and flow configurations before enabling them again.
• For Fay, verify the deployed checkout against its release records and restrict management access to trusted administrators pending confirmed remediation. Treat this as operator containment, not evidence of a vendor fix.
• Make permission to install or change a local server explicit. Display the full executable and arguments before approval. Record the approved definition and require review when it changes. MCP security guidance calls for consent before execution and restricted local-server privileges. MCP security guidance.
• Enforce an allowlist of approved programs and permitted argument forms at process creation. Validate environment overrides there too. Apply the same policy to settings, imported flows and other configuration producers; a check in one user interface is insufficient.
• As an incident-response precaution, isolate a deployment with unexplained child processes, preserve relevant logs, review credentials available to its account, and rebuild from trusted inputs if unauthorized execution is established. Revoke exposed credentials through their issuers.

Pitfalls

A command allowlist must constrain what an allowed program may do. Approving a general-purpose interpreter with arbitrary arguments offers little restriction. Every caller needs authorization to launch processes; being authenticated is insufficient. Keep authorization, launch validation and operating-system confinement as separate checks.