IBM Langflow OSS: Code injection allows remote code execution
Summary
IBM Langflow OSS, an open-source low-code tool for building AI agents and applications, contains a code injection flaw (CWE-94) in its code generation handling. A remote attacker with a valid user account can execute arbitrary code with the privileges of the Langflow process. An attacker with code execution can reach stored credentials and connected data. The flaw is rated CVSS 8.8 (high).
Affected
- IBM Langflow OSS 1.0.0 through 1.12.2
Fixed in
- Upgrade to Langflow OSS 1.12.3 or later (per the CVE record and IBM's bulletin reference).
- IBM's later bulletin recommends 1.13.0 for installations on 1.0.0 to 1.12.8.
Workaround
Unknown. No workaround beyond the upgrade is reported in the sources. Restricting user access and keeping the instance off the public internet reduce exposure but do not fix the flaw.
Exploitation
- Not listed in CISA's Known Exploited Vulnerabilities catalog. CISA SSVC: exploitation none, not automatable.
- No public proof of concept found. Neither the CVE record nor IBM reports exploitation.
Our recommendation
- Inventory all Langflow OSS instances, including those set up by developers, and record their versions.
- Upgrade to 1.13.0 or the latest release, at least to 1.12.3.
- Confirm that authentication is enforced and auto-login is disabled.
- Do not expose Langflow directly to the internet.
- If a vulnerable instance was exposed and misuse cannot be ruled out, rotate the API keys and secrets stored in Langflow.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities www.ibm.com
- IBM Security Bulletin node 7294467 (later Langflow OSS upgrade recommendation) www.ibm.com
- OSV: CVE-2026-93445 osv.dev
- Vulners OSV: CVE-2026-93445 vulners.com
- Strix: CVE-2026-93445 www.strix.ai
- Safeguard.sh: CVE-2026-93445 analysis safeguard.sh
- CSA Singapore advisory AL-2026-099 www.csa.gov.sg
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:33.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.