Block custom components
Custom components and the component code editor allow Langflow users to create and execute Python code in the Langflow runtime. While this freedom is a feature of Langflow, in some deployments you might want to block the creation of custom Langflow components to prevent arbitrary code execution.
To block custom component creation on a Langflow server, set the following environment variable:
_10LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
When set to false, Langflow blocks creating custom components and changing code in the visual editor.
When unset or true, Langflow allows custom code.
Existing Langflow installations will keep the default true behavior until you opt in to this restriction.
This environment variable is a beta feature, and should not be your only safeguard in production environments.
In the event that Langflow could execute untrusted or LLM-generated code, run Langflow in an isolated and containerized execution environment.
Configure a custom component allow-list
LANGFLOW_ALLOW_CUSTOM_COMPONENTS works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
Directories listed in the LANGFLOW_COMPONENTS_PATH environment variable are loaded as custom components and merged into the server’s template set.
When LANGFLOW_ALLOW_CUSTOM_COMPONENTS is set to false, the components in the LANGFLOW_COMPONENTS_PATH directory remain allowed.
To allow some components while blocking others, include the allowed custom components directory in LANGFLOW_COMPONENTS_PATH and set LANGFLOW_ALLOW_CUSTOM_COMPONENTS to false.
LANGFLOW_COMPONENTS_INDEX_PATH points to a prebuilt component index JSON file at a local path or http:// / https:// URL.
This environment variable replaces the default index bundled with the lfx package.
It does not import Python modules from a directory on disk.
To allow-list custom components, use the LANGFLOW_COMPONENTS_PATH environment variable.
If both environment variables are set, Langflow builds one combined set of components from the custom index and from LANGFLOW_COMPONENTS_PATH. If the same component category name exists in both, LANGFLOW_COMPONENTS_PATH replaces that whole category from the custom index.
For more information, see:
