CVE-2026-8447: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in IBM Langflow OSS

CVE-2026-8447 is a stored cross-site scripting (CWE-79) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. The flaw exists in the Playground chat interface, where user input is not properly neutralized during web page generation, allowing malicious script injection. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session, potentially leading to information disclosure and limited integrity impact. The vulnerability requires user interaction and does not affect system availability. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the Playground chat interface and avoid clicking on untrusted links or inputs. Monitor official IBM channels for updates on patches or mitigations.