CVE-2026-97674CWE-94code-injection
CVE-2026-97674
High · published October 7, 2026
What it is
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00300 · 21.6th percentile
- Weakness
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2026-10-07T05:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| langflow/langflow | ≥ 1.0.0, < 1.12.3 | 1.12.3 |
References (1)
EPSS history
Timeline