Description
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
Published: 2026-04-08
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

IBM recommends addressing the vulnerability now by upgrading to IBM Langflow Desktop 1.8.3 or newer  https://www.langflow.org/blog/langflow-1-8-desktop If you are already using Langflow Desktop, upgrade in the application to version 1.8.3 To install Langflow Desktop for the first time, visit Download Langflow Desktop https://langflow.org/desktop .

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
Description IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
Title IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file
First Time appeared Ibm
Ibm langflow Desktop
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:langflow_desktop:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_desktop:1.8.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Desktop
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Desktop
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-04-08T00:19:11.414Z

Reserved: 2026-02-27T18:17:58.431Z

Link: CVE-2026-3357

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-08T01:16:41.057

Modified: 2026-04-08T01:16:41.057

Link: CVE-2026-3357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses