CVE-2026-8635— Python解释器组件任意代码执行漏洞
Possible ATT&CK Techniques 3AI
T1546 · Event Triggered Execution T1059 · Command and Scripting Interpreter T1078 · Valid AccountsAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| IBM | Langflow OSS | 1.0.0≤ 1.10.0 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-8635の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Arbitrary Code Execution in Python Interpreter Component
ソース: NVD (National Vulnerability Database)
脆弱性説明
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
对生成代码的控制不恰当(代码注入)
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| IBM | Langflow OSS | 1.0.0 ~ 1.10.0 | cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:* |
II. CVE-2026-8635の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-8635のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-8635 其他参考 (1)
Same Patch Batch · IBM · 2026-07-17 · 34 CVEs total
| CVE-2026-9135 | 9.9 CRITICAL | Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation |
| CVE-2026-8859 | 9.9 CRITICAL | Path Traversal in APIRequest Component via Content-Disposition Header |
| CVE-2026-8481 | 9.9 CRITICAL | Remote Code Execution via Code Validation Endpoint |
| CVE-2026-8476 | 9.9 CRITICAL | Disk Cache Deserialization Remote Code Execution Vulnerability |
| CVE-2026-13446 | 9.8 CRITICAL | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-9202 | 9.8 CRITICAL | Unauthenticated User Registration Could Lead to Remote Code Execution |
| CVE-2026-9198 | 9.8 CRITICAL | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation |
| CVE-2026-9103 | 9.8 CRITICAL | Unauthenticated Superuser Token Issuance via Auto-Login Endpoint |
| CVE-2026-8505 | 9.8 CRITICAL | Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution |
| CVE-2026-15091 | 9.3 CRITICAL | Multiple Vulnerabilities in IBM Engineering AI hub. |
| CVE-2026-7667 | 8.8 HIGH | Path Traversal Vulnerability in API Request Component Content-Disposition Header Processin |
| CVE-2026-8056 | 8.8 HIGH | Parameter Injection Vulnerability in API Graph Execution Engine |
| CVE-2026-7755 | 8.8 HIGH | MCP Server Configuration Validator Bypass via File Upload API |
| CVE-2026-14499 | 8.8 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-13445 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-13448 | 8.1 HIGH | Langflow is affected by remote code execution, denial of service, path traversal, and expo |
| CVE-2026-13473 | 8.1 HIGH | IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow |
| CVE-2026-9762 | 7.8 HIGH | IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc |
| CVE-2026-7754 | 7.7 HIGH | SSRF Protection Configuration Vulnerability |
| CVE-2026-7872 | 7.5 HIGH | Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authenti |
Showing 20 of 34 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Langflow OSS
- CVE-2026-13445
Langflow is affected by remote code execution, denial of ser - CVE-2026-13446
Langflow is affected by remote code execution, denial of ser - CVE-2026-13448
Langflow is affected by remote code execution, denial of ser - CVE-2026-14499
Langflow is affected by remote code execution, denial of ser - CVE-2026-7667
Path Traversal Vulnerability in API Request Component Conten
同じベンダー: IBM
- CVE-2026-13445
Langflow is affected by remote code execution, denial of ser - CVE-2026-13446
Langflow is affected by remote code execution, denial of ser - CVE-2026-13448
Langflow is affected by remote code execution, denial of ser - CVE-2026-13473
IBM Storage Protect Client is vulnerable to Heap-Based Buffe - CVE-2026-14499
Langflow is affected by remote code execution, denial of ser
同じ弱点: CWE-94
- CVE-2026-8056
Parameter Injection Vulnerability in API Graph Execution Eng - CVE-2026-8481
Remote Code Execution via Code Validation Endpoint - CVE-2026-9135
Policies Component Dynamic CodeInput Fields Bypass Custom Co - CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass - CVE-2026-9762
IBM® Data Server driver for JDBC and SQLJ is vulnerable to r
V. CVE-2026-8635へのコメント
まだコメントはありません