CVE-2026-8635CWE-94

Arbitrary Code Execution in Python Interpreter Component

Critical · published July 17, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00594 · 47.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-17T19:02Z
EPSS history
Timeline
  • 17 JUL 19:02Z
    Arbitrary Code Execution in Python Interpreter Component
    cvelistv5