EUVD-2026-53574
GHSA-4q62-cj5w-qmfx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege authenticated user submits crafted component over the network; no interaction needed; backend code execution yields full CIA impact within unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.
AnalysisAI
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at minimum low-level user privileges on the target Langflow OSS instance (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity network-reachable flaw requiring only authenticated low-privilege access with no user interaction, yielding full confidentiality, integrity, and availability impact on the backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Langflow user with a low-privilege account submits an Agentic Assistant workflow containing a Python component crafted to execute a reverse shell or environment variable dump when evaluated. During backend validation - which occurs automatically before the user reviews or approves the workflow - Langflow's component handler executes the injected Python code under the backend process account, allowing the attacker to exfiltrate API keys and credentials stored in environment variables or read sensitive files on the server. … |
| Remediation | A vendor-released patch is confirmed available per IBM's advisory at https://www.ibm.com/support/pages/node/7282646; administrators should upgrade IBM Langflow OSS to the fixed version specified in that advisory as the primary remediation action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0-1.10.3 and assess network exposure (internet-facing deployments, multi-user access, critical data systems). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today