Executive brief
IBM Langflow OSS, a tool used for building artificial intelligence applications, contains a critical security flaw in its code validation feature. An attacker with basic user access can send malicious Python code that the server will execute immediately without any safety checks. This allows the attacker to take full control of the server, potentially leading to data theft, service disruption, or further attacks on the internal network.
Technical details
A remote code execution (RCE) vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.10.0 due to improper control of generation of code (CWE-94). The vulnerability is located in the `/api/v1/validate/code` endpoint, which utilizes Python's `exec()` function to process user-supplied code. The implementation lacks sandboxing, input validation, or privilege restrictions, allowing the execution of arbitrary system commands. An authenticated attacker can exploit this by submitting malicious code containing executable expressions in default parameters or decorators. The issue has been addressed in version 1.10.1 by removing code execution from the validation path and performing only compilation checks.
Affected products
- IBM Langflow OSS 1.0.0 - 1.10.0
Timeline
- 2026-07-02: advisory: Initial publication by IBM
- 2026-07-17: disclosed: NVD publication date
- 2026-07-17: patched: Remediation via version 1.10.1 confirmed