Executive brief
IBM Langflow OSS is an open-source platform for building AI workflows. An authenticated attacker can bypass command-line argument validation in the MCP stdio server component to execute arbitrary system commands with the privileges of the application process, potentially leading to unauthorized data access, system modification, and lateral movement.
Technical details
This vulnerability is an OS command injection (CWE-78) in Langflow's MCP stdio server configuration that stems from improper validation of command-line arguments. The MCP Tools component, when invoked through a flow, bypasses code-execution restriction settings, and on Windows specifically, the command validator recognizes only one cmd.exe execution switch, allowing attackers to use alternate switches to bypass the command allow-list. Exploitation requires authentication and network access to the Langflow server. Successful exploitation grants arbitrary OS command execution at the privilege level of the application process, enabling credential theft, sensitive data exposure, filesystem modification, and lateral movement to services accessible from the compromised server. Patches should validate all command-line switches and enforce consistent execution guards across all code-execution paths.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed