Live › vulnerability › CVE-2026-101288
IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special elements in code, which lets a remote attacker who has a valid account execute arbitrary code. The NVD rating is high, with a CVSS score of 8.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams that run IBM Langflow OSS between 1.0.0 and 1.12.3 on a server where users log in. The sources do not say which features or configurations are required to reach the flaw, so the exposure of any given deployment is unknown. Installations on a newer version are not in the stated range.
No product ranges from the sources yet.
pip show langflow, and compare it to the affected range 1.0.0 through 1.12.3.1.12.3; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
This page as .md · .json · in your agent: get_signal("CVE-2026-101288")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.