IBM Langflow OSS versions 1.0.0 through 1.10.1 suffer an unauthenticated remote code execution vulnerability caused by an incomplete denylist in the validate_public_flow_no_code_execution() function. Unauthenticated users can POST to the /api/v1/build_public_tmp/{flow_id}/flow endpoint and inject code via the agent components OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent, resulting in remote code execution. The issue is classified as CWE-184 (Path Traversal). The CVE description does not detail denial of service or exposed credentials, so those effects remain uncertain based solely on the provided information.

IBM Langflow OSS version 1.0.0 up to 1.10.1, distributed on IBM's PyPI repository, are affected by this vulnerability.

The CVSS score of 8.1 indicates high severity, while the EPSS score of <1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. Attackers can exploit the public /api/v1/build_public_tmp/{flow_id}/flow endpoint remotely without authentication, enabling full control over the host running Langflow OSS. The CVE description focuses on remote code execution; denial of service or exposed credentials are not explicitly described, so their likelihood remains unclear based on the available data.