CVE-2026-104339
IBM Langflow OSS
- IBM Langflow OSS
- Critical
- CVSS 9.8
- No fixed version listed
Summary
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
From the CVE record.
What to do
No fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| IBM Langflow OSS | from 1.0.0 through 1.12.3 | None listed |
Advisories and fixes
- Vendor advisory www.ibm.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by ibm)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 29, 2026.
- Weakness
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- Vendor
- IBM, Langflow OSS
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.