Loading vulnerability…
Authenticated Remote Code Execution via Untrusted Deserialization in IBM Langflow OSS
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an untrusted-data deserialization vulnerability that allows a remote authenticated attacker to execute arbitrary code on the affected system. The specific vulnerable function and input interface are not identified. IBM assigns a CVSS v3.1 score of 8.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the affected system, potentially compromising the confidentiality and integrity of application-accessible data and the availability of the service. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
No workarounds or mitigations are identified.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.4. Back up the existing installation, review upgrade preparation instructions and release-specific configuration changes, install the updated version, and test existing flows.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.