IBM Langflow OSS versions 1.0.0 to 1.11.5 contain an unguarded eval() call that allows a remote authenticated attacker to execute arbitrary Python code with the privileges of the application process.

The vulnerability affects IBM Langflow OSS 1.0.0 through 1.11.5. Any deployment that has not been updated to 1.11.6 remains vulnerable, and only users with authenticated access to the application can supply the input that reaches the eval() function.

The vulnerability is rated a CVSS score of 8.8, indicating high severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but the requirement of authentication means a determined attacker could gain significant control. The likely attack vector is a remote authenticated user submitting crafted input via the application’s API or user interface that triggers the eval() call, with no additional exploitation prerequisites mentioned beyond authentication.