CVE-2026-110193: Langflow OSS is affected by multiple vulnerabilities
Published Oct 28, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.
Other sources
Langflow OSS could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.
— IBM
Affected Software
1 affected component
IBM Langflow OSS<=1.0.0 - 1.12.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Oct 28, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 29, 2026
CVE Published
via MITRE·03:15 PM
Data Sourced
via MITRE·03:15 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness