IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity with a CVSS score of 8.8. The vulnerability requires authentication but no user interaction and impacts confidentiality, integrity, and availability.