IBM Langflow OSS EUVD-2026-113131

Exploitation requires an authenticated account on the Langflow instance, even if only low-privileged (CVSS PR:L), plus the ability to reach and use the Agentic Assistant feature, which the attacker drives to generate or submit component code employing input patterns the product fails to block - that unblocked-pattern path is the specific trigger. Affected deployments are IBM Langflow OSS versions 1.0.0 through 1.12.8. The principal limiting factor is the authentication requirement: instances that are not exposed to untrusted users, that restrict account creation, or that are network-isolated materially reduce realistic risk, since no fully unauthenticated path is described. No special non-default configuration beyond having the Agentic Assistant available is indicated in the source.

This is a credible, action-worthy vulnerability but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing only a low-privileged authenticated account and no user interaction, yielding full confidentiality, integrity, and availability loss via arbitrary OS command execution (CWE-94). The vuln.today decision label is 'this_week', which aligns with a high-but-not-critical posture: serious impact, but exploitation is gated behind authentication. No EPSS score, no CISA KEV entry, and no public exploit were provided in the input, so there is no evidence of active exploitation or published exploit code at this time - the 8.8 reflects potential impact, not observed in-the-wild activity. The main caveat is the authentication requirement: the attacker must already hold a valid (even low-privileged) Langflow account, which meaningfully limits exposure for instances that are not internet-facing or that restrict account provisioning. No conflicting signals were found between the CVSS vector and the description - both consistently indicate remote, authenticated, low-complexity exploitation.

A remote attacker who holds (or obtains) a low-privileged authenticated account on an IBM Langflow OSS instance (1.0.0-1.12.8) interacts with the Agentic Assistant, steering it to generate or submit component code that uses patterns the product fails to block. The malicious component code is then executed on the server, giving the attacker arbitrary OS command execution. No public exploit code was identified in the provided data, and no user interaction beyond the attacker's own authenticated session is required.