CVE-2026-93674
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- Severity: Critical
- CVSS 9.8
- EPSS 6.24%
- Weaponized (Metasploit/Nuclei)
- P1 · Patch now
Why P1: Metasploit/Nuclei can already hit it.
Description
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Affected products
- langflow >= 1.0.0, < 1.12.3
Weakness
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- NVD record NVD
- CVE Program record CVE Program
- Reference NVD
- GitHub security advisory GitHub