EUVD-2026-53577
GHSA-r7q3-v7gf-v75h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible RCE requiring only low-privilege authentication, no user interaction, scope unchanged; arbitrary code execution yields full CIA impact on the vulnerable host.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.
AnalysisAI
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.
Technical ContextAI
IBM Langflow OSS is an open-source visual framework for building and orchestrating large language model (LLM) application workflows. CWE-94 (Improper Control of Generation of Code) identifies the root cause as insufficient validation or neutralization of user-supplied input that is subsequently interpreted or executed as code by the application runtime - a pattern common in workflow engines and expression evaluators that dynamically process user-defined logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the injection pathway is reachable over the network without elevated privileges and without relying on any precondition beyond a valid user account, indicating attacker-controlled input reaches a code-execution surface through normal application functionality. The affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, covering all builds from 1.0.0 through 1.10.3.
RemediationAI
Apply the vendor-released patch per the IBM security advisory at https://www.ibm.com/support/pages/node/7282646. The exact patched version number is not independently confirmed from available intelligence data - administrators must consult the advisory directly to identify the target upgrade version. As a compensating control while patching, restrict network access to Langflow OSS instances to the minimum set of trusted, known-good user accounts; if the application supports role-based access control, reduce the population of accounts with workflow-creation or expression-execution privileges, since exploitation requires only low-privilege authentication. Disabling dynamic code or expression evaluation features within Langflow workflows may reduce the injectable surface, though this will likely impair core LLM orchestration functionality and should be evaluated against operational requirements. For internet-exposed instances, placing the application behind a VPN or IP allowlist eliminates remote attack vector exposure entirely.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run
Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary oper
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today