EUVD-2026-53574
GHSA-4q62-cj5w-qmfx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege authenticated user submits crafted component over the network; no interaction needed; backend code execution yields full CIA impact within unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.
AnalysisAI
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.
Technical ContextAI
IBM Langflow OSS is an open-source visual framework for composing multi-agent and Retrieval-Augmented Generation (RAG) AI pipelines. Its Agentic Assistant feature dynamically constructs and validates Python-based workflow components generated by an underlying LLM. The root cause - CWE-94 (Improper Control of Generation of Code) - is the absence of sandboxing or execution deferral during this validation step: the backend invokes eval-equivalent Python execution on model-generated code before the owning user has reviewed or approved it. Because Langflow backend processes typically run with elevated OS-level privileges and hold access to environment variables (API keys, credentials), internal service endpoints, and local file system paths, arbitrary code execution at this layer has a large blast radius. The CPE string cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* confirms the flaw spans the entire tracked version range without a product-variant qualifier.
RemediationAI
A vendor-released patch is confirmed available per IBM's advisory at https://www.ibm.com/support/pages/node/7282646; administrators should upgrade IBM Langflow OSS to the fixed version specified in that advisory as the primary remediation action. The exact fixed version number is not independently verifiable from the available data - consult the IBM support page directly to confirm the target upgrade version before deployment. As compensating controls pending patching, restrict access to the Langflow backend to only the minimum set of trusted, explicitly authorized users by enforcing network-level controls such as firewall rules or VPN requirements that prevent untrusted or internet-facing access to the Agentic Assistant validation endpoint. If operationally feasible, disabling the Agentic Assistant feature entirely eliminates the vulnerable code path at the cost of losing AI workflow validation functionality. Additionally, review and tighten OS-level process privileges for the Langflow backend service account to limit the impact of any successful exploitation (principle of least privilege). Avoid exposing Langflow instances to untrusted multi-user environments until the vendor patch is applied.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today