UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105697

Langflow < 1.10.3: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Severity
Critical 9.9
Published
28 Sept 2026
Last changed
9 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.10.3
Also known as
GHSA-w794-rj3p-xv45
Sources
CVE Program, Project advisories (GitHub)

Affected software

SoftwareAffected versions
LangflowServers and applications · cna:langflow-ai|langflow
  • From 1.1.2 before 1.10.3
LangflowServers and applications · github:langflow-ai/langflow
  • From 1.1.2 before 1.10.3

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105697
  • GitHub Advisory Database https://github.com/advisories/GHSA-w794-rj3p-xv45
  • github.com https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45