CVE-2026-19295: Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOWALLOWCUSTOMCOMPONENTS=false policy control.
Other sources
Langflow OSS allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOWALLOWCUSTOMCOMPONENTS=false policy control.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.2 - Compensating control
As described, the vulnerability bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control; enforce additional network/access restrictions to prevent authenticated users from saving/triggering crafted flows until the upgrade to 1.11.2 is applied.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Langflow flow user can exploit it. No user interaction is required, and the attacker can progress from flow-level access to command execution under the server process identity.
Does disabling custom components prevent exploitation?
No. The issue bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
What actions are required to trigger command execution?
The attacker must save a flow containing a crafted type field value, then trigger a build of a wrapper flow that references that flow.
Which releases are identified as affected?
IBM Langflow OSS versions 1.0.0 through 1.11.1 are identified as affected.