Unauthenticated code execution via unsafe exec_globals

Remote code execution in Langflow OSS 1.4.2 allows remote attackers to execute arbitrary Python code through the validate endpoint. The validate_code() path compiles attacker-supplied function definitions and executes them with exec() using an exec_globals scope that exposes Python built-ins and importlib. No authentication or user interaction is required, and successful exploitation runs code with the Langflow service's privileges, reported as root by ZDI.