IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user… (CVE-2026-12946)
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability that allows remote attackers to inject arbitrary code due to improper control of user input code. This vulnerability is identified as CWE-94, indicating code injection issues. The flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
AI Analysis
Technical Summary
The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 arises from improper control of user-supplied code input, enabling remote attackers with low privileges and no user interaction required to inject arbitrary code. This vulnerability has a CVSS 3.1 base score vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary code on the system, potentially leading to full system compromise including unauthorized data access, modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for suspicious activity related to code injection attempts. Avoid exposing vulnerable versions to untrusted networks.
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user… (CVE-2026-12946)
Description
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability that allows remote attackers to inject arbitrary code due to improper control of user input code. This vulnerability is identified as CWE-94, indicating code injection issues. The flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 arises from improper control of user-supplied code input, enabling remote attackers with low privileges and no user interaction required to inject arbitrary code. This vulnerability has a CVSS 3.1 base score vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary code on the system, potentially leading to full system compromise including unauthorized data access, modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected service and monitor for suspicious activity related to code injection attempts. Avoid exposing vulnerable versions to untrusted networks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mj9q-p4gc-9rw2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-12946"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a6bdd8a9c2644c7f8da71ed
Added to database: 07/30/2026, 23:26:02 UTC
Last enriched: 07/30/2026, 23:52:09 UTC
Last updated: 07/31/2026, 02:51:54 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.