IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
Critical 9.8Patch available
CVE-2026-18894
Langflow — code injection.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server…
WeaknessCWE-94: Code injection
Published Updated Source NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.5%
Higher than 44% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Available
See the vendor advisory
What happened
What to do
- 01Check whether you run Langflow, and which version.
- 02Install the fixed version listed in the vendor advisory.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in Langflow
9 more CVEs, 2 actively exploited
8.4Langflow Langflow — Authorization Bypass Through User-Controlled Key.ExploitedEPSS 0.9%9.8Langflow Langflow — Inclusion of Functionality from Untrusted Control Sphere.ExploitedEPSS 63%9.8Langflow — remote code execution.EPSS 0.6%9.8Langflow — remote code execution.EPSS 15%9.8Langflow — remote code execution.EPSS 0.6%9.8Langflow — remote code execution.EPSS 0.7%