CVE-2026-79724
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a critical flaw that lets attackers run any operating‑system commands on the host. The vulnerability is caused by improper handling of special characters in command strings.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM Langflow OSS 1.0.0 to 1.11.5, used by developers building language‑model workflows.
Real-world impact
An attacker could execute arbitrary commands on the server, potentially taking full control, stealing data, or installing malware.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑exploitable without authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources