Loading vulnerability…
CVE-2026-19295 is a critical code-execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.1. Attacker-controlled strings in a saved flow-template type field can reach Pydantic ForwardRef evaluation, which invokes eval() with an unrestricted builtins namespace. An authenticated user can save a flow containing a crafted type value and then trigger construction of a wrapper flow that references it, resulting in arbitrary operating-system command execution in the Langflow server process. The issue bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This two-file repository consists of a short README and poc.py, a standalone Python proof-of-concept exploit for CVE-2026-19295 affecting Langflow 1.10.0. The script accepts a target URL, Langflow username/password, and a required command to execute. It first queries /api/v1/version and refuses to continue unless the target reports exactly version 1.10.0, then logs in through /api/v1/login to obtain a Bearer token. The exploit constructs and submits a malicious Langflow flow containing a custom Python component. Its graph/node data deliberately uses an empty node type, documented in the code as the CVE bypass, while the embedded component code invokes subprocess.check_output with shell=True on the supplied command. The flow is subsequently triggered and the script polls job events to retrieve command output, which is deliberately placed in an exception message. This is a functioning authenticated RCE exploit rather than a detection-only utility; although it also labels patched/vulnerable outcomes, its central action creates and executes attacker-controlled code on the target. No fixed external host, IP address, or command-and-control endpoint is embedded; all network requests are directed to the operator-provided Langflow base URL.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authenticated command-execution and privilege-escalation vulnerability in IBM Langflow OSS. A flow user can craft a flow type field and build a referencing wrapper flow to execute arbitrary OS commands as the Langflow server process, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false control.
A critical authenticated remote code execution vulnerability in IBM Langflow OSS caused by insufficient code-execution policy enforcement. It enables an authenticated flow user to bypass LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false and execute arbitrary operating-system commands as the Langflow server-process identity.
A critical authenticated OS command-execution vulnerability in Langflow OSS. Attacker-controlled flow-template type strings reach Pydantic ForwardRef evaluation, which invokes eval() with unrestricted built-ins, enabling execution under the server-process identity and bypassing LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.