Loading vulnerability…
OS Command Injection in IBM Langflow OSS
CVE-2026-93674 is an OS command injection vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.12.2. Improper neutralization of special elements used in operating system commands allows remote arbitrary code execution. The specific vulnerable function and endpoint are not established. IBM assigns a CVSS v3.1 score of 9.8 and describes exploitation without authentication or user interaction; however, public proof-of-concept and Metasploit implementations describe authenticated blind command injection requiring valid Langflow credentials. The mechanism corresponds to CWE-78, although IBM classifies the vulnerability as CWE-94.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command or code execution with the privileges of the Langflow service process, potentially compromising confidentiality, integrity, and availability. Accessible information may include API keys, model credentials, environment variables, user data, prompts, and workflow configurations. Data modification, exfiltration, service disruption, persistence, and lateral movement are possible depending on service privileges and access to other resources.
If you can’t patch tonight, do this now.
IBM lists no vulnerability-specific workaround. Until upgrading, restrict network access to authorized users and trusted networks and remove unnecessary public exposure. Run Langflow with least privilege and limit access to secrets, sensitive storage, and unnecessary network destinations. Monitor for unexpected child processes, suspicious command activity, unusual outbound connections, and access to service secrets. These measures reduce exposure and impact but do not replace patching.
Patch, then assume compromise.
Upgrade affected deployments to Langflow OSS 1.12.3 or later, the minimum fixed version identified by IBM, preferably a current supported release incorporating the fix. Inventory deployed instances, verify installed versions, and prioritize network-reachable systems. A secondary reference recommends 1.13.0 or later, but IBM's stated minimum fixed release is 1.12.3. If compromise is suspected, investigate the deployment and rotate credentials and secrets accessible to the service.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.