IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation

Langflow Langflow2026-10-29 16:17 UTC1 min readRead in

Summary

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

Remediation

Inventory every Langflow Langflow deployment, including staging.
Upgrade Langflow Langflow to 1.12.5.
Confirm the running version after the upgrade.

References

Patchhttps://www.ibm.com/support/pages/node/7293016

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected versions

Version	Fixed in
1.0.0 – <1.12.5	1.12.5

Weakness

CWE-94

Exploit probability (EPSS)

0.9%

Timeline

2026-10-29Publicly disclosed

Sources

NVD