CVE-2026-13435 - Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Back Back to CVE browser

CRITICAL

Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Published Jul 30, 2026

9.9

CRITICAL

CVSS 3.1

EPSS 0.53%

Description

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.1

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-94

Code Injection

References (1)

https://www.ibm.com/support/pages/node/7279987
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7279987		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jul 30, 2026

Updated Jul 31, 2026

Reserved Jun 26, 2026

Link CVE-2026-13435

CISA Vulnrichment

Updated Jul 30, 2026

NVD

Status Analyzed

Modified Aug 4, 2026

Link CVE-2026-13435

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-13435