CVE-2026-104328: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Other sources
Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.4.
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as affected. The provided information does not state whether any particular deployment mode or configuration changes exposure.
What access does an attacker need to exploit this issue?
An attacker must be remotely reachable and authenticated. No user interaction is required, and the attack complexity is rated low.
What is the potential impact of successful exploitation?
Successful exploitation could allow arbitrary code execution on the affected Langflow OSS environment. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.