Critical · 9.8 CVE-2026-79724 EUVD-2026-75794GHSA-x3hp-6r77-cxgw

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Published Sep 10, 2026 · Updated Sep 12, 2026 · Assigned by ibm

Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow OSS	1.0.0 – ≤ 1.11.5	—

Advisories 2

NCSC-2026-0392 Kwetsbaarheden verholpen in IBM Langflow OSS en IBM MQ Appliance NCSC-NL (Netherlands) · Sep 23, 2026
WID-SEC-2026-3239 Langflow OSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2026

References

https://www.ibm.com/support/pages/node/7286666 vendor-advisory patch