Loading vulnerability…
Authenticated code injection in IBM Langflow OSS
CVE-2026-97679 is a code injection vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.12.2. Improper input validation and inadequate neutralization of special elements used in operating-system commands could allow a remote authenticated attacker to execute arbitrary code. The affected function and precise injection entry point are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could result in arbitrary code execution on the affected system. The resulting execution privileges and specific consequences for confidentiality, integrity, and availability are not specified.
If you can’t patch tonight, do this now.
No vendor workaround or mitigation is listed. Supplementary hardening recommendations include validating user inputs and restricting operating-system command execution; these measures are not established as complete alternatives to upgrading.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later and apply applicable vendor security patches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.