CVE-2026-93674: Langflow OSS is affected by multiple vulnerabilities
Published Oct 2, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Other sources
Langflow OSS could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
— IBM
Affected Software
2 affected components
IBM Langflow OSS<=1.0.0-1.12.2
Langflow Langflow>=1.0.0<1.12.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.3
Event History
Oct 2, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 7, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The vulnerability is rated as network-accessible with no privileges required and no user interaction required; its attack complexity is rated low.
2
What could a successful attacker do?
A remote attacker could execute arbitrary code. The severity vector indicates high potential impact to confidentiality, integrity, and availability.