{"id":"CVE-2026-104328","kind":"vulnerability","aliases":["CVE-2026-104328"],"related":[],"title":"Langflow: authenticated user can run OS commands on the server","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special characters passed to an OS command. A logged-in remote attacker can use this to execute arbitrary code on the host running Langflow.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["versions-outside-range"],"how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow` and compare it to the affected range 1.0.0 through 1.12.3.\n- Confirm whether the Langflow instance is reachable from the internet or untrusted networks.","fix":"- Move Langflow OSS to a version above `1.12.3`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:29:16+00:00","updated_at":"2026-10-29T16:29:16+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:29:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move Langflow OSS to a version above `1.12.3`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Langflow: authenticated user can run OS commands on the server","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special characters passed to an OS command. A logged-in remote attacker can use this to execute arbitrary code on the host running Langflow.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the Langflow server","analyst_note":"Find the IBM advisory and the fixed version, and identify which Langflow feature reaches the OS command.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow` and compare it to the affected range 1.0.0 through 1.12.3.\n- Confirm whether the Langflow instance is reachable from the internet or untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range"],"who_is_affected":"Teams running IBM Langflow OSS between 1.0.0 and 1.12.3 where users can log in and reach the server. The sources do not describe the specific feature or code path, so the exact configuration needed is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4103,"output_tokens":548,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104328':13A,16A '-2026':12A,15A '1.0.0':29B,63C '1.12.3':31B,65C 'ai':18B 'ai-tool':17B 'allow':67C 'arbitrari':53B,74C 'attack':47B,71C 'authent':2A,70C 'charact':36B 'code':54B,75C 'command':7A,41B,87C 'could':66C 'cve':11A,14A 'due':76C 'element':82C 'execut':52B,73C 'fail':32B 'host':24B,57B 'ibm':25B,60C 'improp':78C 'langflow':1A,20B,26B,59B,61C 'log':44B 'logged-in':43B 'neutral':34B,79C 'os':6A,40B,86C 'oss':27B,62C 'pass':37B 'python':21B 'remot':46B,69C 'run':5A,58B 'self':23B 'self-host':22B 'server':10A 'special':35B,81C 'tool':19B 'use':49B,83C 'user':3A 'version':28B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Langflow OSS between 1.0.0 and 1.12.3 where users can log in and reach the server. The sources do not describe the specific feature or code path, so the exact configuration needed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104328","severity":null,"published_at":"2026-10-29T16:17:44+00:00","modified_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}