What is the CVSS score of CVE-2026-13435?

CVE-2026-13435 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by CVE-2026-13435?

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a critical remote code execution vulnerability that allows authenticated users to escape the PythonREPL sandbox and execute arbitrary code on…. A patch is available.

How to fix or mitigate CVE-2026-13435?

Within 24 hours: conduct a complete inventory of all IBM Langflow OSS instances in production, identify those running versions 1.0.0 through 1.10.1, and implement network segmentation or access restrictions to limit exposure. Within 7 days: apply the available vendor patch to all affected Langflow instances and verify deployment success. Within 30 days: confirm all systems are running patched versions, review access logs for suspicious activities during the exposure window, and enforce mandatory software update policies for orchestration platforms.

IBM Langflow OSS CVE-2026-13435

EUVD-2026-51244 CRITICAL

Code Injection (CWE-94)

2026-07-30 ibm

GHSA-h7x8-fr4c-w46c

RCE IBM Code Injection Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable, low-complexity code injection needing a low-privileged account (PR:L); sandbox escape crosses the security boundary (S:C) yielding full host compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:52 vuln.today

CVE Published

Jul 30, 2026 - 16:48 cve.org

CRITICAL 9.9

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Langflow is an open-source, low-code framework for building LLM-driven agent and RAG workflows, where components such as PythonREPL let flow authors execute Python inside a supposedly restricted sandbox. The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection): the sandbox's input validation fails to fully constrain the code or inputs it evaluates, so attacker-supplied content is interpreted as executable Python rather than inert data. The affected artifact is identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, spanning the 1.0.0-1.10.1 release line.

RemediationAI

Patch available per vendor advisory: upgrade IBM Langflow OSS to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7279987 (the input data does not include an exact fixed version number, so confirm the target version directly from that advisory before deploying). Until patched, reduce exposure by restricting who can create or edit flows that use the PythonREPL component and by enforcing strong authentication and least-privilege on Langflow accounts, since exploitation requires an authenticated low-privileged user - the trade-off is reduced flexibility for legitimate flow authors. Additionally, place the Langflow instance behind network access controls (VPN or IP allowlisting) and avoid exposing it directly to the internet; where feasible, disable or remove PythonREPL-based components entirely, accepting the loss of that scripting capability, to eliminate the code-injection surface.