CVE-2026-7873Critical· 9.9▾ AbyssalPoC availableLangflow: Code Injection Vulnerability in Code Validation Endpoint
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 54.5 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
1.1%
1 GitHub repo · Metasploit ×1 (last check)
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
langflow >= 1.0.0, < 1.10.1.rc0Upgrade to a patched release:
langflow 1.10.1.rc0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-51886Critical· 9.8langflow-ai langflow v1.9.3 is affected by: Code Injection
CVE-2026-48519Critical· 9.6Langflow: Unauthenticated RCE in Shareable Playgrounds
CVE-2026-93674Critical· 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVE-2026-10561Critical· 9.9Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
CVE-2026-7700Medium· 6.3A weakness has been identified in langflow-ai langflow up to 1.10.2
CVE-2025-3248Critical· 9.8Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint