CVE-2026-107329: Code Injection

Published Oct 29, 2026

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Langflow OSS to a version that resolves this vulnerability.
Fixed in 1.12.5
Operational
Back up the existing Langflow OSS installation before upgrading.
Operational
Test your flows after installing Langflow OSS 1.12.5.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected. An attacker must be able to authenticate remotely; unauthenticated attackers are not described as able to exploit it.

What level of access and impact does exploitation involve?

Exploitation requires low-level privileges and no user interaction. A successful attacker can execute arbitrary code, with high impact to confidentiality, integrity, and availability, including impacts beyond the vulnerable security authority.

CVE-2026-107329: Code Injection

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What level of access and impact does exploitation involve?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What level of access and impact does exploitation involve?