Description
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Published: 2026-10-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

IBM Langflow OSS releases 1.0.0 through 1.12.2 contain a flaw where a malicious actor can supply manipulated content that the system accepts as executable code. The vulnerability, classified as CWE-94, allows an attacker to cause the server to run arbitrary code, potentially giving full control over the host machine or the application environment.

Affected Systems

The affected product is IBM Langflow OSS. Versions from 1.0.0 up to and including 1.12.2 are vulnerable; the recommendation is to upgrade to 1.12.3, which contains the fix.

Risk and Exploitability

The CVSS score of 9.8 denotes a critical severity, and although an EPSS score is not available, this indicates that exploit data is sparse or not yet measured. The vulnerability is not listed in the CISA KEV catalog. Based on the description, a direct network attack vector is inferred; any client with network access to the Langflow service could construct a payload that triggers the code execution pathway.

Generated by OpenCVE AI on October 7, 2026 at 01:56 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.12.3. https://pypi.org/project/langflow/#description

OpenCVE Recommended Actions

  • Upgrade IBM Langflow OSS to version 1.12.3 or later.
  • After upgrade, configure input validation to restrict or sanitize data sent to the code generation engine, ensuring only trusted content is allowed.
  • Continuously monitor application logs for unexpected code execution attempts and isolate or downgrade the service if suspicious activity is detected.

Generated by OpenCVE AI on October 7, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Langflow
Langflow langflow
CPEs cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*
Vendors & Products Langflow
Langflow langflow

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Title Langflow OSS is affected by multiple vulnerabilities
First Time appeared Ibm
Ibm langflow Oss
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Oss
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Oss
Langflow Langflow
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-08T12:57:38.114Z

Reserved: 2026-10-01T20:05:44.094Z

Link: CVE-2026-104334

cve-icon Vulnrichment

Updated: 2026-10-08T12:57:33.987Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T01:16:34.223

Modified: 2026-10-08T18:25:32.700

Link: CVE-2026-104334

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T04:00:09Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')