{"id":"CVE-2026-104339","kind":"vulnerability","aliases":["CVE-2026-104339"],"related":[],"title":"Langflow: OS command injection lets remote attackers run arbitrary code","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special elements in input passed to an operating system command. A remote attacker can use this to execute arbitrary code on the server running Langflow.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","langflow","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Langflow version, for example with `langflow --version` or `pip show langflow`, and see whether it falls within `1.0.0` through `1.12.3`.\n- Confirm whether the Langflow instance is reachable from the internet or an untrusted network.","fix":"- Move to a Langflow OSS release newer than `1.12.3`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:27:44+00:00","updated_at":"2026-10-29T16:27:44+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:27:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Langflow OSS release newer than `1.12.3`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Langflow: OS command injection lets remote attackers run arbitrary code","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special elements in input passed to an operating system command. A remote attacker can use this to execute arbitrary code on the server running Langflow.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the Langflow server.","analyst_note":"Find the vendor advisory from IBM and the fixed version, and the affected endpoint and whether authentication is required.","how_to_check":"- Check the installed Langflow version, for example with `langflow --version` or `pip show langflow`, and see whether it falls within `1.0.0` through `1.12.3`.\n- Confirm whether the Langflow instance is reachable from the internet or an untrusted network.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM Langflow OSS in the affected range, especially where the instance accepts requests from untrusted networks. Sources do not describe which Langflow endpoint or configuration triggers the flaw, so the exact exposure surface is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":4098,"output_tokens":577,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-104339':13A,16A '-2026':12A,15A '1.0.0':31B,65C '1.12.3':33B,67C 'agent':19B 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'allow':69C 'arbitrari':9A,55B,75C 'attack':7A,49B,72C 'code':10A,56B,76C 'command':3A,46B,88C 'could':68C 'cve':11A,14A 'due':77C 'element':38B,83C 'execut':54B,74C 'fail':34B 'host':26B 'ibm':27B,62C 'improp':79C 'inject':4A 'input':40B 'langflow':1A,23B,28B,61B,63C 'let':5A 'neutral':36B,80C 'oper':44B 'os':2A,87C 'oss':29B,64C 'pass':41B 'remot':6A,48B,71C 'run':8A,60B 'self':25B 'self-host':24B 'server':59B 'special':37B,82C 'system':45B 'tool':22B 'use':51B,84C 'version':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Langflow OSS in the affected range, especially where the instance accepts requests from untrusted networks. Sources do not describe which Langflow endpoint or configuration triggers the flaw, so the exact exposure surface is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104339","severity":null,"published_at":"2026-10-29T16:17:44+00:00","modified_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}