plaincve:~$

// threat brief

CVE-2026-93674

IBM Langflow OSS OS command injection could let a remote attacker run arbitrary code

CVSS
9.8 CRITICAL
CISA KEV
Not listed
Weakness
CWE-94
Topics
AI security

PlainCVE Team · Published 2026-10-11 · AI-assisted · Press brief ↓

AI review 2026-10-11 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

IBM Langflow OSS 1.0.0–1.12.2 mishandles special characters in OS commands, so a remote attacker may run arbitrary code; the CVE record says upgrade to 1.12.3.

Who is affectedOrganizations running Langflow OSS 1.0.0 through 1.12.2 (including 1.12.2). According to the CVSS score, the attack works over the network with no privileges or login and no user interaction; IBM's own text, however, does not say "unauthenticated".
What happensA successful attacker could run arbitrary code on the server. The CVSS score rates the impact on confidentiality, integrity and availability as High for all three.
What to do nowUpgrade to Langflow OSS 1.12.3, as recommended by the CVE record (written by IBM as the CNA). The vendor has published no workaround.
Affected versions1.0.0 through 1.12.2 (including 1.12.2)
Fixed versions1.12.3 (per the CVE record; one third-party news site said a patch was still awaited, see body)
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-10-02

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your Langflow OSS version

    Versions 1.0.0 through 1.12.2 (including 1.12.2) are affected. No source says which feature or setting is involved, so treat any version in that range as affected.

  2. 02Look for suspicious child processes started by Langflow

    TheHackerWire advises SOC analysts to watch for unexpected shell child processes spawned by the Langflow application. This is general third-party advice; none of the sources we reviewed give vendor detection guidance or indicators of compromise.

    Step 3
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to Langflow OSS 1.12.3

    The CVE record (written by IBM as the CNA) strongly recommends upgrading to 1.12.3. Note: the 1.12.3 release notes do not mention this CVE, and no source names the fix commit.

    Step 2
  2. 02Can't upgrade yet: isolate the network and restrict outbound traffic

    The vendor offers no workaround. TheHackerWire suggests putting Langflow in a dedicated VLAN (a separate virtual network) with strict outbound filtering. This is third-party advice and does not replace upgrading.

    Step 1Step 4
RESPONDRespondIf you find signs of compromise
  1. 01If you see suspicious signs, treat the host as possibly compromised

    This is PlainCVE's general suggestion; none of the sources we reviewed give incident-response guidance. Because the impact is arbitrary code execution, if you find unknown child processes started by Langflow, isolate the host from the network first, then investigate the data and credentials it could reach.

    Step 3Step 4
HARDENHardenPrevent the next one
  1. 01Don't expose Langflow directly to untrusted networks

    The CVSS score indicates the attack works over the network without login, so the fewer people who can reach the service, the lower the risk. This is PlainCVE's suggestion based on the score.

    Step 1
  2. 02Keep watching for advisory updates

    NVD completed its analysis on 2026-10-08 (status Analyzed) without adding a CVSS score of its own; it lists only IBM's score. GitHub's advisory was still marked unreviewed as of 2026-10-11. The affected range or classification may still be updated later.

Full remediation steps and notes
  1. Check your version first. Anything from 1.0.0 to 1.12.2 needs action.
  2. Upgrade to 1.12.3. This is the recommendation in the CVE record, written by IBM as the CNA (the organization that assigns the CVE ID). The Langflow maintainers released 1.12.3 on 22 September.
  3. About the conflicting fix status: TheHackerWire, an automated news site, says instances are “awaiting a vendor patch”, which contradicts the CVE record naming 1.12.3. Also, the 1.12.3 release notes do not mention this CVE, and no source names the fix commit. PlainCVE follows the CVE record’s advice but cannot independently confirm the fix from the code changes.
  4. If you can’t upgrade yet: the vendor offers no workaround. TheHackerWire suggests network isolation and strict outbound filtering; this only lowers risk and does not replace upgrading.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

IBM Langflow OSS OS command injection could let a remote attacker run arbitrary code: 1. The attacker sends crafted input to a Langflow server over the network → 2. Langflow carries special characters from the input into an OS command → 3. The server runs the attacker's code → 4. The attacker may read or change data, or disrupt the serviceCVE-2026-93674 · IBM Langflow OSS OS command injection could let a remote attacker runarbitrary codeAttackerYour systemThe attacker sends crafted input to a Langflow server over the network — According to the CVSS score, no privileges, login or user interaction are needed. No source names the specific component or endpoint. 1The attacker sendscrafted input to aLangflow serverover the networkLangflow carries special characters from the input into an OS command — Affected versions do not properly neutralize these special characters, so the input may change what the command means. 2Langflow carriesspecial charactersfrom the inputinto an OS commandThe server runs the attacker's code — IBM's security bulletin says a remote attacker could use this to execute arbitrary code. 3The server runsthe attacker's codeThe attacker may read or change data, or disrupt the service — The CVSS score rates the impact on confidentiality, integrity and availability as High. 4The attacker mayread or changedata, or disruptthe serviceAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-93674-langflow-os-command-injection · CC BY 4.0
IBM Langflow OSS OS command injection could let a remote attacker run arbitrary code: 1. The attacker sends crafted input to a Langflow server over the network → 2. Langflow carries special characters from the input into an OS command → 3. The server runs the attacker's code → 4. The attacker may read or change data, or disrupt the serviceCVE-2026-93674 · IBM Langflow OSS OScommand injection could let a remoteattacker run arbitrary codeThe attacker sends crafted input to a Langflow server over the network — According to the CVSS score, no privileges, login or user interaction are needed. No source names the specific component or endpoint. 1AttackerThe attacker sends craftedinput to a Langflow server overthe networkLangflow carries special characters from the input into an OS command — Affected versions do not properly neutralize these special characters, so the input may change what the command means. 2Your systemLangflow carries specialcharacters from the input intoan OS commandThe server runs the attacker's code — IBM's security bulletin says a remote attacker could use this to execute arbitrary code. 3Your systemThe server runs the attacker'scodeThe attacker may read or change data, or disrupt the service — The CVSS score rates the impact on confidentiality, integrity and availability as High. 4AttackerThe attacker may read or changedata, or disrupt the serviceAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-93674-langflow-os-command-injection
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker sends crafted input to a Langflow server over the network

    According to the CVSS score, no privileges, login or user interaction are needed. No source names the specific component or endpoint.

    Defense: Don't expose Langflow directly to untrusted networks; TheHackerWire suggests putting it on its own network segment.

  2. Your system

    Langflow carries special characters from the input into an OS command

    Affected versions do not properly neutralize these special characters, so the input may change what the command means.

    Defense: Upgrade to 1.12.3, as the CVE record recommends.

  3. Your system

    The server runs the attacker's code

    IBM's security bulletin says a remote attacker could use this to execute arbitrary code.

    Defense: Watch for unusual shell child processes started by Langflow (general advice from TheHackerWire).

  4. Attacker

    The attacker may read or change data, or disrupt the service

    The CVSS score rates the impact on confidentiality, integrity and availability as High.

    Defense: TheHackerWire suggests strict outbound (egress) filtering so injected code has a harder time connecting out.

Who is affected

VersionStatus
Langflow OSS 1.0.0 through 1.12.2 (including 1.12.2)Affected
Langflow OSS 1.12.3Version the CVE record recommends upgrading to

Attack conditions (from the CVSS score): the attack works over the network, with low complexity, no privileges or login, and no user interaction. Note that IBM’s text only says “remote attacker”; it does not itself say “unauthenticated”. The “no login” part comes from the CVSS field “Privileges Required: None”.

What we don’t know: no source names the vulnerable component, endpoint or code path, so there is no way to tell whether a particular setup avoids the problem. If your version is in the affected range, treat it as affected.

Don’t mix them up: IBM’s same bulletin also lists CVE-2026-97674, which has a similar description but requires the attacker to be logged in and scores 8.1. This is PlainCVE’s note: they are different vulnerabilities, and this page covers only CVE-2026-93674.

How it works

An “OS command” is an instruction a program asks the server’s operating system to run. If a program pastes outside input straight into such a command, certain characters with special meaning (for example, symbols that separate or chain commands) can change what the whole command does, letting an attacker slip in instructions of their own. Affected Langflow versions do not properly “neutralize” these characters (that is, strip them of their special meaning), and IBM says this could let a remote attacker execute arbitrary code.

A small classification mismatch (our analysis): the description talks about OS command injection, but the CVE record classifies it as CWE-94 (code injection) rather than CWE-78, the usual category for OS command injection. No source explains the difference.

The flawed approach (conceptual illustration, not Langflow’s code):

Show code example(python)
import subprocess
# Outside input is glued into one command string and handed to a shell,
# so the shell interprets any special characters in it
subprocess.run("some-tool --input " + user_value, shell=True)

A safer approach:

Show code example(python)
import subprocess
# Pass a list of arguments and skip the shell; the input is treated as one plain argument
subprocess.run(["some-tool", "--input", user_value])

Timeline

DateEvent
2026-09-18CVE ID reserved
22 Sep (the release page snapshot shows only day and month)Langflow maintainers release 1.12.3
2026-10-02IBM publishes its security bulletin (first public disclosure)
2026-10-07CVE record published; NVD publishes its entry the same day, with analysis still in progress at that time
2026-10-07Not listed in CISA KEV as of this date
2026-10-08NVD completes its analysis (Analyzed) without adding a CVSS score of its own

Further reading

  • Scoring: CVSS 3.1 base score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored by IBM. NVD completed its analysis on 2026-10-08 without adding a CVSS score of its own; it lists only IBM’s score.
  • Exploitation: not in CISA KEV as of 2026-10-07. No source reports exploitation in the wild, and no source says it was exploited before a patch existed (a zero-day). TheHackerWire found no public proof-of-concept exploit at the time it published. According to FIRST, the EPSS score (the estimated chance of exploitation in the next 30 days) was 2.66% on 2026-10-11 (about the 85.3rd percentile); the score changes daily and was 0.756% on 2026-10-07.
  • GitHub advisory: the GitHub Advisory Database tracks this as GHSA-xhw9-mf2x-qh4j, currently marked unreviewed.
  • Detection: none of the sources we reviewed give vendor detection guidance; TheHackerWire’s general advice is to watch for suspicious shell child processes started by Langflow.
  • Related weakness types: CWE-94 (the classification in the CVE record) and CWE-78 (OS command injection; in PlainCVE’s analysis it fits the description more closely, but it is not listed).

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-11 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-93674 Record (CVE Services API) · CVE Program / IBM (CNA), 2026-10-07 · accessed 2026-10-07
  2. AdvisorySecurity Bulletin: Langflow OSS is affected by multiple vulnerabilities · IBM, 2026-10-02 · accessed 2026-10-07
  3. CVE / NVD / OSVNVD - CVE-2026-93674 · NIST, 2026-10-07 · accessed 2026-10-07
  4. AdvisoryGitHub Advisory Database - GHSA-xhw9-mf2x-qh4j · GitHub · accessed 2026-10-07
  5. Patch / releaseLangflow releases (1.12.3) · langflow-ai (GitHub) · accessed 2026-10-07
  6. NewsCVE-2026-93674: IBM Langflow OSS OS Command Injection Enables Remote Code Execution · TheHackerWire · accessed 2026-10-07
  7. OtherFIRST EPSS API - CVE-2026-93674 · FIRST, 2026-10-11 · accessed 2026-10-11
  8. ResearchCVE-2026-93674 · Strix · accessed 2026-10-07
  9. OtherCISA Known Exploited Vulnerabilities Catalog (JSON feed) · CISA · accessed 2026-10-07

Press brief

In one sentence

IBM Langflow OSS versions 1.0.0 through 1.12.2 have a critical flaw (CVE-2026-93674): the software does not properly handle special characters in operating-system commands, which could let a remote attacker execute arbitrary code. Its CVSS 3.1 score is 9.8 (Critical). IBM published its security bulletin on October 2, 2026, and the CVE record was published on October 7; both recommend upgrading to 1.12.3. As of that date it was not in CISA's Known Exploited Vulnerabilities catalog, and no source had reported exploitation in the wild.

Key facts

Severity
CVSS 3.1 9.8 (Critical), scored by IBM cveawg.mitre.org
Affected versions
Langflow OSS 1.0.0 through 1.12.2 cveawg.mitre.org
Recommended upgrade
1.12.3 (CVE record) cveawg.mitre.org
First disclosed (IBM security bulletin)
2026-10-02 ibm.com
CVE published
2026-10-07 cveawg.mitre.org
GitHub advisory ID
GHSA-xhw9-mf2x-qh4j (unreviewed) api.github.com
EPSS
2.66% (FIRST, 2026-10-11, about the 85.3rd percentile; changes daily, was 0.756% on 2026-10-07) api.first.org

Confirmed

  • Langflow OSS 1.0.0 through 1.12.2 is affected, and a remote attacker could execute arbitrary code (IBM security bulletin and CVE record).
  • The CVSS 3.1 score is 9.8, with no privileges and no user interaction required.
  • The CVE record recommends upgrading to 1.12.3; the Langflow maintainers released 1.12.3 on 22 September.
  • As of 2026-10-07, it is not listed in CISA KEV.

Unconfirmed / disputed

  • Sources disagree on the fix: the CVE record names 1.12.3, while TheHackerWire says instances are awaiting a vendor patch; the 1.12.3 release notes do not mention this CVE.
  • No source names the vulnerable component, endpoint or code path, or the fix commit.
  • No source reports exploitation in the wild or exploitation before a patch existed.
  • IBM's own text does not say "unauthenticated"; "no login needed" comes only from the CVSS score.

Quotable line

When a program pastes outside input straight into a system command, that input stops being data and starts being instructions.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "IBM Langflow OSS OS command injection could let a remote attacker run arbitrary code". PlainCVE. https://plaincve.date/en/vulns/cve-2026-93674-langflow-os-command-injection (accessed YYYY-MM-DD)
BibTeX
@misc{cve202693674langflowoscommandinjection2026,
  title  = {IBM Langflow OSS OS command injection could let a remote attacker run arbitrary code},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-93674-langflow-os-command-injection},
  note   = {Updated 2026-10-11}
}