IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to

Summary

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

Remediation

1. Inventory every Langflow Langflow deployment, including staging.
2. Upgrade Langflow Langflow to 1.12.4.
3. Confirm the running version after the upgrade.

References

• Patchhttps://www.ibm.com/support/pages/node/7293015