IBM Langflow OSS 1.0.0 through 1.10.0 lets authenticated attackers submit components with socket/urllib imports that bypass an incomplete scanner blocklist, enabling SSRF and arbitrary Python execution as root. Impact includes AWS credential theft via IMDSv1, container file exfiltration, and lateral movement to Docker-network services (PostgreSQL/Redis). Upgrade to 1.10.1 to mitigate.