CVE-2026-17625 — Langflow is affected by OS Command Injection in Model Context Protocol features

CVE-2026-17625

Langflow is affected by OS Command Injection in Model Context Protocol features PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.3

CWE

CWE-78

References

https://www.ibm.com/support/pages/node/7282147

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.