CVE-2026-104339: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Other sources
Langflow OSS could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.4.
Event History
Frequently Asked Questions
Which versions are affected?
IBM Langflow OSS versions 1.0.0 through 1.12.3 are identified as affected.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction.
What is the potential security impact?
The CVSS assessment rates confidentiality, integrity, and availability impact as high.