CVE-2026-3357: IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow Desktopto a version that resolves this vulnerability.Fixed in 1.8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3357?
CVE-2026-3357 has been assessed as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-3357?
To fix CVE-2026-3357, update IBM Langflow Desktop to version 1.8.3 or later, which resolves the insecure deserialization issue.
Who is affected by CVE-2026-3357?
CVE-2026-3357 affects users of IBM Langflow Desktop versions 1.6.0 through 1.8.2.
What is the impact of CVE-2026-3357?
The impact of CVE-2026-3357 includes the possibility for authenticated users to execute arbitrary code on the system.
Is CVE-2026-3357 a local or remote vulnerability?
CVE-2026-3357 is classified as a remote vulnerability, allowing execution of code from an authenticated user remotely.