Skip to main content
IMMUNITYSEC

CVE-2026-7873

Code Injection Vulnerability in Code Validation Endpoint

Updated

CVSS 3.1
9.9 CRITICAL
EPSS
6.9% (94th pct)
CISA KEV
Not listed
Published
2026-06-30
Weakness
CWE-94

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

Key Findings

as of 2026-11-12
All KEV statistics→
  • Its current EPSS score (6.9%) is higher than that of 20% of CISA KEV entries.

Severity

CVSS 3.1 · CNA · Base score9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CVSS calculator
SSVC · CISA-ADP
Exploitationnone
Automatableno
Technical impacttotal

Affected Products

ProductAffected versions
IBM
Langflow OSS
1.0.0 to 1.10.0

References

1 links

Vendor advisories

Record Details

Published
2026-06-30
Last updated
2026-07-01
Assigner (CNA)
ibm
Credited to
-

More from IBM

CVE-2026-936749.8 CRITICAL

Langflow OSS is affected by multiple vulnerabilities

IBMEPSS 15.3%2026-10-07
CVE-2022-479869.8 CRITICAL

IBM Aspera Faspex code execution

IBMKEVEPSS 99.965%2023-02-17
CVE-2019-471610 CRITICAL

IBM Planning Analytics Remote Code Execution Vulnerability

IBMKEVEPSS 86.4%2019-12-18
CVE-2020-44279 CRITICAL

IBM Data Risk Manager Security Bypass Vulnerability

IBMKEVEPSS 70.0%2020-05-07

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.