CVE-2026-101288: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
Other sources
Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.4.
Event History
Frequently Asked Questions
Does exploiting this issue require user interaction?
No. The vulnerability is rated UI:N, indicating that an attacker does not need a separate user to perform an action for exploitation.
Does successful exploitation cross a security authority boundary?
No. The CVSS vector specifies S:U (scope unchanged), so the impact is assessed within the vulnerable component's existing security authority.