{"id":"CVE-2026-93445","published":"2026-10-07T01:16:34.657","lastModified":"2026-10-08T18:23:20.317","description":"IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-94"],"vendors":["langflow"],"products":["langflow"],"references":[{"url":"https://www.ibm.com/support/pages/node/7290694","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The IBM Langflow OSS application contains a code generation vulnerability that allows authenticated attackers to execute arbitrary code on the system. This represents a critical security flaw because it enables remote code execution through improperly controlled code generation features.","exploitability":"Exploitation requires an authenticated user account with access to the code generation functionality, making it moderately difficult to exploit but still highly impactful.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary commands on the Langflow server, potentially leading to full system compromise and data exfiltration across all applications using the platform.","remediation":"Upgrade to IBM Langflow OSS version 1.12.3 or later to remediate this code generation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:30.146Z"}}