EUVD-2026-51273
GHSA-mj9q-p4gc-9rw2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable app with low-privilege authenticated user (PR:L) able to inject code that escapes the app scope (S:C) for full host compromise; no user interaction and low complexity.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
AnalysisAI
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Langflow OSS web application or API and a low-privilege authenticated session (CVSS PR:L), but no user interaction (UI:N) and only low attack complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege authenticated account on a network-reachable Langflow instance crafts a flow component containing malicious code that the platform evaluates server-side, executing arbitrary commands as the Langflow process user. Because the scope changes, the attacker can pivot from the application into the host system, harvesting credentials or the AI application's connected secrets and API keys. … |
| Remediation | Patch available per vendor advisory - upgrade IBM Langflow OSS to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7278928 (consult that page for the exact fixed version, as a specific patched version string was not provided in the input data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Langflow OSS deployments and identify systems running versions 1.0.0 through 1.10.0; restrict network access to affected systems and review authentication logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today