CVE-2026-17625 describes an OS command injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw arises from improper neutralization of special elements used in OS commands, enabling a remote attacker with authentication privileges to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow a remote authenticated attacker to execute arbitrary OS commands, potentially leading to full system compromise including unauthorized data access, modification, or denial of service. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users only and monitor for suspicious activity related to command execution. Avoid exposing vulnerable interfaces to untrusted networks.