Threats Tagged 'cve-2026-19295'

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical vulnerability (CVE-2026-19295) that allows an authenticated user to escalate privileges and execute arbitrary operating system commands on the server. This occurs by saving a flow with a specially crafted type field and triggering a build of a wrapper flow referencing it, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical vulnerability that allows an authenticated attacker to execute arbitrary operating system commands on the server. This occurs by saving a flow with a specially crafted type field and triggering a build of a wrapper flow referencing it. The vulnerability bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy, enabling privilege escalation from an authenticated flow user to OS-level command execution under the server process identity.

Langflow, an open-source visual interface for building LLM-based applications, has multiple vulnerabilities identified under CVE-2026-18729. These vulnerabilities relate to code injection issues as indicated by CWE-94. The affected versions include all releases prior to 1.11.2. The severity of these vulnerabilities is assessed as high. There is no information about available patches or known exploits in the wild. The vendor advisory or patch status is not provided, so remediation guidance should be sought from the official vendor sources.