IBM Langflow OSS 1.0.0 through 1.10.0 includes a flaw in the disk‑based caching mechanism where the AsyncDiskCache class calls Python's pickle.loads() on cached data without any validation, integrity checks, or authentication. This represents a CWE-502 (Deserialization of Untrusted Data) weakness, where pickle can execute arbitrary code during deserialization. A corrupted or maliciously crafted pickle file can cause the Langflow server process to run arbitrary code, leading to complete system compromise. The vulnerability directly affects confidentiality, integrity, and availability as the attacker gains the full privileges of the server process.

IBM Langflow OSS versions from 1.0.0 through 1.10.0 are affected. The enumerated versions 1.0.0 and 1.10.0 indicate that all releases in that range are vulnerable and should be patched or upgraded to the latest release.

The CVSS score of 9.9 demonstrates a critical impact, while the EPSS score of less than 1% indicates that widespread exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw by influencing cached data through file system access, manipulating workflow inputs, providing custom components, or altering API calls to place a malicious pickle payload in the cache, after which the server process will deserialize and execute it.