Threats tagged 'ghsa-pf68-vvvh-6f8f'

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote attacker to execute stored Python component code within a public workflow. This execution occurs under the flow owner's runtime context on the server, bypassing intended trust boundaries that restrict public execution to server-trusted code. The vulnerability is identified as CVE-2026-18894 and has a medium severity rating with a CVSS score of 6.5.