Live › vulnerability › CVE-2026-107328
IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to neutralize code passed to eval/exec. A logged-in attacker can make the server run code of their choosing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted Langflow OSS in the affected range are exposed, most of all where accounts are shared or sign-up is open. Hosted or managed Langflow services are handled by their operator; the sources do not say which vendor builds are affected. Instances already on a newer release than 1.12.4 are not in the stated range.
No product ranges from the sources yet.
langflow --version or the package manager, and compare against the affected range 1.0.0 through 1.12.4.1.12.4; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
This page as .md · .json · in your agent: get_signal("CVE-2026-107328")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.