CVE-2026-13435 is a critical code injection vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.10.1. The flaw exists in the PythonREPL sandbox implementation where input validation is insufficient, allowing attackers to inject and execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 9.9, reflecting its critical impact on confidentiality, integrity, and availability. The vulnerability requires network access and low privileges but no user interaction, and it can result in a complete system compromise due to the ability to execute arbitrary code remotely.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized code execution with high impact on confidentiality, integrity, and availability. Attackers can execute arbitrary code remotely, potentially leading to data theft, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor IBM's advisories for updates and apply patches or mitigations as soon as they become available. Until then, restrict network access to the affected service and limit privileges where possible.