Executive brief
IBM Langflow OSS, a tool used to build and manage AI workflows, contains a security flaw in its Python code execution component. An attacker with basic access can bypass security restrictions to run unauthorized code on the server. This could lead to the theft of sensitive information, including API keys, database credentials, and encryption keys used to secure user sessions.
Technical details
A code injection vulnerability (CWE-94) exists in the Python Interpreter and legacy Python REPL Tool components of IBM Langflow OSS. The vulnerability stems from improper input validation in the sandbox implementation, which is intended to restrict code execution to a safe environment with limited imports and built-ins. An authenticated attacker can provide crafted input to a flow or agent that bypasses these restrictions. Successful exploitation allows the attacker to execute arbitrary code, potentially leading to the exposure of environment variables, provider API keys, database credentials, and JWT symmetric signing keys. The issue is resolved in version 1.10.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.1
Timeline
- 2026-07-14: disclosed: Initial publication of the security bulletin by IBM
- 2026-07-14: patched: Fix released in version 1.10.2
- 2026-07-30: advisory: NVD publication date