目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2026-9196— IBM Langflow OSS 代码注入漏洞

CVSS 8.1 · High EPSS 0.27% · P18

Affected Version Matrix 1

ベンダープロダクトVersion Rangeステータス
IBMLangflow OSS1.0.0≤ 1.10.3affected
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2026-9196の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
ソース: CVE Program / CVE List V5
脆弱性説明
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
对生成代码的控制不恰当(代码注入)
ソース: CVE Program / CVE List V5
脆弱性タイトル
IBM Langflow OSS 代码注入漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
IBM Langflow OSS是美国IBM公司的一款可视化构建AI工作流的低代码工具平台。 IBM Langflow OSS 1.0.0版本至1.10.3版本存在代码注入漏洞，该漏洞源于对LLM生成组件处理不当，在验证期间用户批准之前执行模型生成的Python代码，可能导致攻击者以Langflow后端进程权限触发副作用，如出站网络访问、文件系统交互或数据泄露。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
IBMLangflow OSS 1.0.0 ~ 1.10.3 cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*

II. CVE-2026-9196の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2026-9196のインテリジェンス情報

请登录查看更多情报信息。

CVE-2026-9196 厂商安全公告 (1)

Same Patch Batch · IBM · 2026-08-05 · 32 CVEs total

CVE-2026-176268.8 HIGHLangflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-176328.8 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-81828.8 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-92018.8 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-84788.8 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-176238.8 HIGHLangflow is affected OS Command Injection in Model Context Protocol features
CVE-2026-176338.5 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-176248.5 HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation,
CVE-2026-90778.5 HIGHReliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Proto
CVE-2026-176178.5 HIGHServer-Side Request Forgery (SSRF) in IBM Application Gateway Operator
CVE-2026-100258.2 HIGHIBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
CVE-2026-84008.1 HIGHMultiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebS
CVE-2026-81837.7 HIGHLangflow OSS is affected by arbitrary code execution in custom component validation and tr
CVE-2026-84467.5 HIGHLangflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-84707.4 HIGHLangflow is affected by weaknesses in secret handling and sensitive configuration access
CVE-2026-92057.4 HIGHLangflow is affected by weaknesses in secret handling and sensitive configuration access
CVE-2026-176257.2 HIGHLangflow is affected by OS Command Injection in Model Context Protocol features
CVE-2026-176307.2 HIGHLangflow is affected by security vulnerabilities in Model Context Protocol features
CVE-2026-91307.1 HIGHLangflow OSS is affected by arbitrary code execution in custom component validation and tr
CVE-2026-90817.1 HIGHLangflow OSS is affected by server-side request forgery in provider validation and API req

Showing 20 of 32 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: Langflow OSS
同じベンダー: IBM
同じ弱点: CWE-94

V. CVE-2026-9196へのコメント

まだコメントはありません

コメントを残す