CVE-2026-9196 - Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Back Back to CVE browser

HIGH

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Published Aug 5, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.53%

Description

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.10.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Langflow OSS

n/a

Version	Status	Constraints
1.0.0	affected	<=1.10.3

Remediation

Vendor solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

Weaknesses (1)

CWE-94

Code Injection

References (1)

https://www.ibm.com/support/pages/node/7282646
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7282646		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Aug 5, 2026

Updated Aug 7, 2026

Reserved May 21, 2026

Link CVE-2026-9196

CISA Vulnrichment

Updated Aug 6, 2026

NVD

Status Analyzed

Modified Aug 7, 2026

Link CVE-2026-9196

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9196