Skip to main content
IMMUNITYSEC

CVE-2026-93674

Langflow OSS is affected by multiple vulnerabilities

Updated

CVSS 3.1
9.8 CRITICAL
EPSS
15.3% (97th pct)
CISA KEV
Not listed
Published
2026-10-07
Weakness
CWE-94

Description

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Key Findings

as of 2026-11-12
All KEV statistics→
  • Its current EPSS score (15.3%) is higher than that of 30% of CISA KEV entries.

Severity

CVSS 3.1 · CNA · Base score9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CVSS calculator
SSVC · CISA-ADP
Exploitationnone
Automatableyes
Technical impacttotal

Affected Products

ProductAffected versions
IBM
Langflow OSS
1.0.0 to 1.12.2

References

1 links

Vendor advisories

Record Details

Published
2026-10-07
Last updated
2026-10-08
Assigner (CNA)
ibm
Credited to
-

More from IBM

CVE-2026-78739.9 CRITICAL

Code Injection Vulnerability in Code Validation Endpoint

IBMEPSS 6.9%2026-06-30
CVE-2022-479869.8 CRITICAL

IBM Aspera Faspex code execution

IBMKEVEPSS 99.965%2023-02-17
CVE-2019-471610 CRITICAL

IBM Planning Analytics Remote Code Execution Vulnerability

IBMKEVEPSS 86.4%2019-12-18
CVE-2020-44279 CRITICAL

IBM Data Risk Manager Security Bypass Vulnerability

IBMKEVEPSS 70.0%2020-05-07

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.