EUVD-2026-45306
GHSA-q4fv-x4j4-jx84
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable app requiring a valid low-privilege account (PR:L) and no user interaction; command injection yields full host code execution, so C/I/A all High.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.
AnalysisAI
OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.
Technical ContextAI
Langflow is an open-source, Python-based low-code framework for building LLM/agent workflows, distributed by IBM as Langflow OSS. The affected surface is the Python Interpreter component, a node that evaluates user-provided code as part of a flow. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied input reaches an OS command context without adequate sanitization, allowing shell metacharacters or command constructs to break out into the host shell. The CPE data was not supplied in the input; affected products are known only from the NVD-style version range (1.0.0-1.10.1). The 'elevated privileges' note indicates the resulting commands run at the privilege level of the Langflow server process, which in many container or service deployments is root or a broadly privileged service account.
RemediationAI
Consult the IBM advisory at https://www.ibm.com/support/pages/node/7279996 for the vendor's fixed release and upgrade to the patched version above 1.10.1 once identified - the input data did not include an exact fix version, so verify the target version directly from that advisory before deploying. As compensating controls where immediate patching is not possible: restrict who can log in to Langflow (the flaw requires an authenticated account, so tightening account provisioning and removing shared or self-service accounts materially reduces exposure); place the Langflow UI/API behind a VPN or network ACL so it is not internet-reachable, cutting the AV:N attack path; and run the Langflow process as a low-privileged, non-root service account inside a locked-down container to blunt the 'elevated privileges' impact. If your workflows do not require it, disabling or removing access to the Python Interpreter component removes the vulnerable feature at the cost of losing custom-code flow functionality. Note that network restrictions do not protect against a malicious or compromised internal user with a valid account.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today