Five Critical Langflow OSS Flaws Enable Remote Code Execution and File Write

IBM disclosed five high-severity vulnerabilities in Langflow OSS affecting versions 1.0.0 through 1.10.0, including multiple paths to remote code execution, privilege escalation, and arbitrary file write. The issues are tracked as CVE-2026-9135, CVE-2026-8476, CVE-2026-8481, CVE-2026-8635, and CVE-2026-8859. Reported weaknesses include code injection through unvalidated dynamic CodeInput fields in the Policies component, unsafe pickle.loads() deserialization in the disk cache, direct execution of user-supplied Python in the /api/v1/validate/code endpoint, database manipulation that can elevate an authenticated user to superuser, and path traversal in the APIRequest component's Save to File feature via crafted Content-Disposition filenames.

Several of the flaws require only authenticated access and can lead to arbitrary Python or system command execution with the privileges of the Langflow server process, creating a path to full host compromise in some deployments. IBM released Langflow OSS 1.10.1 to address all five vulnerabilities and advised organizations to upgrade immediately; additional mitigation guidance includes reviewing file-system permissions and sanitizing or removing cached data where possible. Public reporting said no active exploitation had been confirmed at publication time.