IBM Langflow OSS versions 1.0.0 through 1.12.3 do not properly neutralize special elements used in an OS command. A remote attacker with a valid, low-privileged account can execute arbitrary code on the server without user interaction, which may expose stored credentials such as API keys. Langflow listens on localhost by default, so the risk depends on how it is deployed and who can reach it.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data unsafely. A remote attacker with any valid Langflow account can execute arbitrary code on the server, with the privileges of the Langflow service. The vendor rates the issue CVSS 8.8 and no user interaction is required.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data from the message broker. A remote attacker who can reach the message broker can execute arbitrary code on the system. The NVD record rates the issue CVSS 9.8 (critical), but other sources rate it lower, so the score should be verified. No exploitation is known.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an improper access control flaw that allows a remote attacker with a valid user account to execute arbitrary SQL commands. Successful exploitation could allow an attacker to read, modify or delete data in the underlying database. NVD lists a CVSS score of 8.8, while IBM lists 8.5 with a scope change for this CVE.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) flaw. A remote attacker with a low-privilege authenticated account can make the server send requests to other systems, which may expose sensitive information. The NVD and IBM CVSS scores differ, so check the current NVD record before relying on either score.
IBM · Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection flaw (CWE-94) caused by improper neutralization of special elements. A remote attacker with a valid low-privilege account can execute arbitrary code on the server, with high impact to confidentiality, integrity and availability (CVSS 8.8). The exact vulnerable component and trigger are not publicly described.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
