CVE-2026-104308: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
Other sources
Langflow OSS could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading, then test your flows after installing version 1.12.4.
Event History
Frequently Asked Questions
Which deployments are within the disclosed affected version range?
The disclosure identifies IBM Langflow OSS versions 1.0.0 through 1.12.3 as affected.
What access does an attacker need to exploit this issue?
An attacker must be remotely authenticated and have low privileges. User interaction is not required.
What is the expected security impact?
The disclosed impact is denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact and a low availability impact.