IBM Langflow OSS: Code injection in Agentic Assistant allows OS command execution

Summary

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a code injection flaw in the Agentic Assistant, which generates and validates component code for flows. A remote attacker with any low-privileged authenticated account can cause the assistant to generate or submit component code using unblocked patterns. Successful exploitation results in arbitrary operating system command execution on the server, exposing stored API keys, data and connected systems. No public proof of concept or exploitation in the wild has been found so far.

Affected

• IBM Langflow OSS 1.0.0 through 1.12.8
• Affected component: Agentic Assistant (component code generation)
• Attacker needs a valid low-privileged account on the instance

Fixed in

• Upgrade to IBM Langflow OSS 1.13.0 or later (secondary sources; verify the fixed version on the IBM bulletin page)
• pip users: pip install langflow --upgrade
• Docker users: pull the latest tagged image

Workaround

Unknown. The vendor bulletin does not list a workaround for this CVE. Interim measures recommended by the analysis (not vendor-confirmed for this CVE): disable the Agentic Assistant until the patched version is deployed, restrict Langflow accounts to people who need them, and keep the instance off the public internet.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No evidence of exploitation in the wild found; one tracker lists it as not known to be exploited
• No public proof of concept found
• EPSS 0.76 % (percentile 55)
• Not yet checked: NVD record and CISA KEV catalog

Our recommendation

• Upgrade Langflow OSS to 1.13.0 or later as soon as practical, after confirming the fixed version on the IBM bulletin page
• Until patched, disable the Agentic Assistant if it is not required, and review and limit Langflow user accounts
• Do not expose Langflow to the public internet; bind it to localhost or place it behind authentication and network controls
• Review logs for unusual component code creation or unexpected process execution on the Langflow server
• Rotate API keys and credentials stored in Langflow if misuse is suspected

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities www.ibm.com
• IBM Security Bulletin (Agentic Assistant, related) www.ibm.com
• HOL: CVE-2026-93680 Langflow upgrade to 1.13.0 hol.org
• OffSeq threat radar: CVE-2026-110193 radar.offseq.com
• Strix: CVE-2026-110193 www.strix.ai
• VulDB: CVE-2026-110193 vuldb.com
• GitHub advisory GHSA-v8hw-mh8c-jxfc (related Agentic Assistant issue) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:12.