{"id":"CVE-2026-7873","kind":"vulnerability","aliases":["CVE-2026-7873","GHSA-v798-mcc6-2m3m"],"related":[],"title":"Langflow: Code Injection Vulnerability in Code Validation Endpoint","description":"IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.","summary":"Langflow, an open-source framework for building LLM apps, has a code injection flaw in its code validation endpoint. An logged-in attacker can run arbitrary OS commands and read sensitive files such as credentials on the server.","severity":"critical","cvss":9.9,"epss":0.01071,"exploited":false,"exploited_at":null,"products":[{"name":"langflow","fixed":["1.10.1.rc0"],"affected":">= 1.0.0, < 1.10.1.rc0","ecosystem":"pypi"},{"name":"langflow","fixed":[],"affected":">= 1.0.0, <= 1.10.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","cwe-94","langflow","python","self-hosted"],"not_affected_if":["auth-required","langflow-below-1.0.0-or-1.10.1rc0-plus"],"how_to_check":null,"fix":"Upgrade the langflow PyPI package to 1.10.1.rc0 or later.","status":"open","published_at":"2026-06-30T20:17:31+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:43:42+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T21:43:42Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the langflow PyPI package to 1.10.1.rc0 or later.\nunknown","reach":"network","impact":"high","summary":"Langflow, an open-source framework for building LLM apps, has a code injection flaw in its code validation endpoint. An logged-in attacker can run arbitrary OS commands and read sensitive files such as credentials on the server.","category":"ai-tooling","who_cares":["langflow","python","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs OS commands on server and reads stored credentials","analyst_note":"Confirm the exact affected endpoint path and a version check or config check for exposure at https://github.com/advisories/GHSA-v798-mcc6-2m3m.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["langflow-below-1.0.0-or-1.10.1rc0-plus","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2827,"output_tokens":367,"severity_before":"critical"},"analyst_status":"queued","analyst_note":"Confirm the exact affected endpoint path and a version check or config check for exposure at https://github.com/advisories/GHSA-v798-mcc6-2m3m.","search":"'-2026':10A,18A '-7873':11A,19A '-94':26B '1.0.0':75C '1.10.0':77C '2m3m':16A 'ai':23B 'ai-tool':22B 'allow':78C 'app':41B 'arbitrari':59B,83C 'attack':56B,80C 'authent':79C 'build':39B 'code':2A,6A,44B,49B 'command':61B,85C 'complet':93C 'compromis':95C 'credenti':68B,91C 'cve':9A,17A 'cwe':25B 'enabl':92C 'endpoint':8A,51B 'execut':82C 'file':65B,89C 'flaw':46B 'framework':37B 'ghsa':13A 'ghsa-v798-mcc6-2m3m':12A 'host':31B 'ibm':72C 'includ':90C 'inject':3A,45B 'langflow':1A,20A,21A,27B,32B,73C 'later':97C 'llm':40B 'log':54B 'logged-in':53B 'mcc6':15A 'movement':98C 'open':35B 'open-sourc':34B 'os':60B,84C 'oss':74C 'python':28B 'read':63B,87C 'run':58B 'self':30B 'self-host':29B 'sensit':64B,88C 'server':71B 'sourc':36B 'system':94C 'tool':24B 'v798':14A 'valid':7A,50B 'vulner':4A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-30T20:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v798-mcc6-2m3m","url":"https://github.com/advisories/GHSA-v798-mcc6-2m3m","severity":"critical","published_at":"2026-06-30T21:31:44+00:00","modified_at":"2026-10-23T20:51:08+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-7873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7873","severity":null,"published_at":"2026-06-30T20:17:31+00:00","modified_at":"2026-07-02T19:15:22+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}