EUVD-2026-53576
GHSA-xhf7-92wh-rvrx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible submission requires only low-privileged auth; AST bypass yields arbitrary code execution warranting C:H/I:H/A:H with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.
AnalysisAI
Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.
Technical ContextAI
IBM Langflow OSS is an open-source AI workflow orchestration platform that enables users to design and deploy LLM-based pipelines by wiring together components, including user-supplied Python code blocks. To guard against malicious code execution, the platform implements an AST (Abstract Syntax Tree)-based security scanner intended to inspect Python submissions before they are executed. CWE-94 (Improper Control of Generation of Code - Code Injection) identifies the root cause: the AST scanner fails to correctly detect or block certain malicious Python constructs - for example, obfuscated syntax, indirect attribute lookups, or dynamically constructed callables - allowing crafted payloads to pass validation and be executed by the underlying Python interpreter. The affected scope is confirmed by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* covering all releases from 1.0.0 through 1.10.3. Because code execution is an intended product capability, the attack surface is inherent to the platform's design, and the bypass of the AST guard is the sole exploitation barrier.
RemediationAI
Apply the vendor-released patch confirmed available via IBM Security Advisory at https://www.ibm.com/support/pages/node/7282646. The exact fixed version number is not specified in available intelligence and must be confirmed directly from the advisory before upgrading. If immediate patching is not feasible, implement network-layer controls to restrict access to the Langflow interface to only trusted internal networks or specific user IP ranges, reducing external attack surface without disabling the product - note this does not mitigate insider threat or compromised accounts. Additionally, audit and minimize the set of authenticated user accounts with access to code execution features, applying principle of least privilege. These compensating controls reduce exposure but do not eliminate the vulnerability; full remediation requires the vendor patch.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today