Threat level Severe
Contact
High 8.8Patch available
CVE-2026-107328

Langflow — remote code execution.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

WeaknessCWE-94: Code injection
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.9%
Higher than 58% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Available
See the vendor advisory

What happened

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

What to do

  1. 01Check whether you run IBM Langflow OSS, and which version.
  2. 02Install the fixed version listed in the vendor advisory.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
IBM47 CVEs in 30 days
All IBM CVEs

Other CVEs in IBM Langflow OSS

5 more CVEs

All IBM Langflow OSS CVEs
9.8Langflow — security bypass.EPSS 2.2%9.8Langflow — remote code execution.EPSS 0.6%8.8Langflow — remote code execution.EPSS 0.7%8.8Langflow — remote code execution.EPSS 0.9%9.8Langflow — remote code execution.EPSS 0.7%