Langflow OSS CVE-2026-107326

Exploitation requires valid authenticated access to a Langflow OSS instance at a low privilege level (CVSS PR:L) and network reachability to that instance (AV:N); no user interaction is needed (UI:N). The vulnerability is OS command injection (CWE-78) via improper neutralization of special elements in an OS command, but the specific product feature, endpoint, or configuration that reaches the command sink is not described in the available sources. Limiting factors that reduce real-world risk: the attacker must already possess credentials (so exposure depends heavily on whether the instance is internet-facing and whether self-registration or weak authentication is enabled), and only deployments running affected versions 1.0.0 through 1.12.4 are vulnerable. The vendor has published a patch; per the available evidence, updating is the remediation path.

This is a serious, actionable vulnerability but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-level authentication, with high confidentiality, integrity, and availability impact (score 8.8) - consistent with authenticated OS command injection (CWE-78) yielding code execution. Exploitation status: no public exploit identified at time of analysis; there is no KEV listing and no POC reference in the input. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The strongest positive signal is the vendor-provided priority Decision label of 'this_week', which indicates meaningful urgency without being 'act_now' or 'emergency'. The key mitigating factor is the PR:L authentication requirement: an attacker must first hold valid (even low-privileged) credentials to a Langflow instance, which narrows the realistic attacker population to insiders, credential-phished users, or internet-exposed instances with weak/registration-open auth. Net assessment: a real priority to patch within the vendor-suggested window, elevated because the outcome is full RCE, but tempered by the authentication prerequisite and the absence of any confirmed exploitation or public exploit code.

An attacker who holds low-privileged credentials to an internet-reachable Langflow OSS instance (versions 1.0.0-1.12.4) authenticates and submits input containing unneutralized shell metacharacters to the vulnerable command-handling path, causing the server to execute attacker-controlled OS commands. Because scope is unchanged (S:U) and impact is high across C/I/A, this grants code execution in the context of the Langflow process on the host. No public exploit code is identified at time of analysis, and the exact feature that reaches the OS command sink is not described in the available sources.