Live › vulnerability › CVE-2026-110186
IBM Langflow OSS versions 1.0.0 through 1.12.8 fail to control code generation, so input can be turned into code that runs. A remote attacker could execute arbitrary code on the server running Langflow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running IBM Langflow OSS from 1.0.0 through 1.12.8, especially self-hosted instances that accept input from users or the network. Instances on a version above 1.12.8 or kept off untrusted networks are less exposed. The sources do not say which configurations are vulnerable by default.
No product ranges from the sources yet.
langflow --version or pip show langflow1.12.8 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
This page as .md · .json · in your agent: get_signal("CVE-2026-110186")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.