← CVE Intelligence

CVE-2026-76059

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

Affected (CNA)

Vendor / productVersions
IBM / Langflow OSSaffected 1.0.0 through 1.11.5

CWE

CWE-693

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.