IBM · Langflow OSS
A code injection flaw in the Code Validation endpoint of IBM Langflow OSS (versions 1.0.0 through 1.10.0) lets an attacker inject code that the component then processes. An authenticated attacker with network access and no user interaction can execute arbitrary OS commands and read sensitive files, including credentials, which can enable full system compromise and lateral movement.
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
Public exploit code (Metasploit) was available the same day.
7 fixes in langflow over 3 months. The latest fix listed for langflow is 1.10.1.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: langflow.
Upgrade to 1.10.3 or later
Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2024-37014, CVE-2025-3248, +10).
pip install "langflow>=1.10.3"First fixed in 1.10.1.rc0 for CVE-2026-7873.
| If you run | Upgrade to |
|---|---|
| 1.0.0 up to 1.10.1.rc0 | 1.10.3first fix for this CVE: 1.10.1.rc0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.