The vulnerability in IBM Langflow OSS allows any authenticated user to send Python code to the POST /api/v1/validate/code endpoint, which executes that code directly via the Python exec() function without sandboxing or validation. This results in arbitrary execution of system commands with the same privileges as the Langflow server process, effectively granting the attacker full control of the server. The flaw is a classic code injection weakness, identified as CWE‑94.

IBM Langflow OSS versions 1.0.0 through 1.10.0 are affected. The vulnerability exists in the code validation API endpoint of these releases and permits execution of arbitrary Python code by authenticated users.

The CVSS score of 9.9 indicates a critical severity, and though the EPSS score is below 1%, indicating a low likelihood of exploitation at present, the vulnerability is not listed in CISA KEV. An attacker must be authenticated to exploit the flaw, but once authenticated can execute any system command on the host. The lack of sandboxing or privilege checks makes this a direct path to full system compromise if the Langflow service runs with elevated rights.