Servers and applications

CVE-2026-104339

Langflow OSS is affected by multiple vulnerabilities

Severity: Critical 9.8
Published: 29 Oct 2026
Last changed: 30 Oct 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 1.12.4
Sources: NVD, CVE Program

Description

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Affected software

Software	Affected versions
LangflowServers and applications · `cna:ibm\|langflow oss`	From 1.0.0 up to 1.12.3
LangflowServers and applications · `cpe:a:langflow:langflow`	From 1.0.0 before 1.12.4

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2026-104339
CVE.org https://www.cve.org/CVERecord?id=CVE-2026-104339