Live › vulnerability › CVE-2026-107326
IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to neutralize special characters passed to an operating system command. A logged-in remote attacker can use this to execute arbitrary code on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running IBM Langflow OSS from 1.0.0 through 1.12.4, typically self-hosted instances where users can log in. The sources do not say which feature triggers the command injection, so the exact exposed path is unknown. Teams on versions outside that range are not affected.
No product ranges from the sources yet.
pip show langflow) and see whether it falls within 1.0.0 through 1.12.4.1.12.4 (the sources do not name the exact fixed release).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
This page as .md · .json · in your agent: get_signal("CVE-2026-107326")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.