CVE-2026-17625CWE-78command-injection

CVE-2026-17625

High · published August 5, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00805 · 56.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-05T22:16Z
Affected products (1)
ProductVersionsFixed in
langflow/langflow≥ 1.0.0, < 1.11.01.11.0
References (1)
https://www.ibm.com/support/pages/node/7282147 · [email protected]
EPSS history
Timeline
  • 05 AUG 17:17Z
    Langflow is affected by OS Command Injection in Model Context Protocol features
    cvelistv5