IBM Langflow EUVD-2026-32494

Exploitation requires that an attacker can reach Langflow's archive-handling functionality - the import/extraction path that unpacks a user-supplied archive - and supply an archive containing a malicious symbolic link entry. Per the CVSS vector (PR:N, UI:N), no authentication and no user interaction are required, and AC:L means no special timing or non-default tuning is needed, so the realistic precondition is simply network access to a Langflow instance running an affected version (1.0.0 through 1.9.1) with the archive import/extraction feature available. The main limiting factors are deployment reachability (instances kept off untrusted networks or behind authentication are not directly exposed) and version (builds outside the 1.0.0-1.9.1 range, or a patched release, are not affected); there is no documented requirement for a non-default configuration in the available data.

The CVSS 3.1 base score of 9.8 reflects the worst-case combination of network attack vector, low complexity, no privileges, no user interaction, and high confidentiality/integrity/availability impact (scope unchanged), which is internally consistent with an unauthenticated remote code execution flaw. However, several real-world exploitation signals are MISSING from the provided data: no EPSS probability, no CISA KEV listing, no SSVC decision values, and no proof-of-concept reference are present, so 'no public exploit identified at time of analysis' applies. This means the severity rests on the theoretical CVSS rating rather than confirmed exploitation evidence. The lack of EPSS/KEV data does not lower the intrinsic danger of an unauthenticated RCE on an internet-reachable AI development platform, but it does mean active, widespread exploitation cannot be asserted from this dataset; defenders facing internet-exposed Langflow instances should still treat this as a high-priority patch given the AV:N/PR:N/UI:N profile.

An attacker reaches an internet-exposed or otherwise network-accessible Langflow OSS instance and submits a maliciously crafted archive (e.g., a flow/component import) containing a symbolic link entry that points outside the extraction directory. When Langflow unpacks the archive without validating the link, attacker-controlled content is written to a sensitive path, and the attacker leverages that write to execute arbitrary code on the server. No proof-of-concept was provided in the source data, but the CVSS AV:N/AC:L/PR:N/UI:N vector indicates the attack requires only network reachability with no authentication or victim interaction.