Loading vulnerability…
Authenticated OS Command Injection Denial of Service in IBM Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection vulnerability caused by improper neutralization of special elements used in an operating system command. A remote authenticated attacker can exploit the flaw to cause denial of service. The affected function and exact input vector are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt service availability. Arbitrary code execution and confidentiality or integrity impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
No workaround or mitigation is specified.
Patch, then assume compromise.
Upgrade to Langflow OSS version 1.12.4. Back up the existing installation, review upgrade preparation instructions and release-specific configuration changes, and test flows after upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.