CVE-2026-3357 — IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file

CVE-2026-3357

IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file PUBLISHED

Description (CNA)

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow Desktop	affected 1.6.0 through 1.8.2

CWE

CWE-502

References

https://www.ibm.com/support/pages/node/7268428

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.