Code injection in IBM Langflow OSS Python Interpreter (CVE-2026-8635)

CVE-2026-8635 is a code injection vulnerability (CWE-94) in IBM Langflow OSS affecting the Python Interpreter component. Authenticated users can execute arbitrary Python code via the PythonREPLComponent due to insufficient sandboxing and validation, enabling privilege escalation to superuser, direct database manipulation, arbitrary system command execution, and full system compromise with Langflow service permissions. The vulnerability carries a CVSS v3.1 base score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 9.9 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7278925 Details: https://vuln.today/cve/CVE-2026-8635