CVE-2026-7873CWE-94

Code Injection Vulnerability in Code Validation Endpoint

Critical · published June 30, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01071 · 64.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-30T19:13Z
EPSS history
Timeline
  • 30 JUN 19:13Z
    Code Injection Vulnerability in Code Validation Endpoint
    cvelistv5