Langflow OSS Multiple Vulnerabilities (RCE/CVE) Advisory 1.0.0-1.12.2

Vulnerability Overview Langflow OSS has multiple vulnerabilities involving code execution restrictions, access control, sensitive data handling, file access, and archive processing. Attackers may exploit these vulnerabilities to execute arbitrary code, read or modify unauthorized data, leak sensitive information, or cause denial of service. Affected Scope Affected Product: Langflow OSS Affected Versions: 1.0.0-1.12.2 Operating Systems: Mac OS, Linux, Windows Remediation IBM strongly recommends immediately remediating the vulnerabilities by upgrading to Langflow OSS version 1.12.3. Vulnerability Details 1. CVE-2026-104334 - Description: Langflow OSS allows remote attackers to execute arbitrary code due to improper control of code generation. - CVSS Base Score: 9.8 2. CVE-2026-97677 - Description: Authenticated stream authors can write attacker-controlled file contents into any directory writable by the service account, bypassing platform local file access isolation protections. - CVSS Base Score: 8.1 3. CVE-2026-97676 - Description: Authenticated remote attackers can execute arbitrary code due to sandbox escape caused by improper use of special elements. - CVSS Base Score: 8.8 4. CVE-2026-101329 - Description: Authenticated remote attackers can obtain sensitive information due to improper access control. - CVSS Base Score: 6.5 5. CVE-2026-97680 - Description: Authenticated remote attackers can obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem. - CVSS Base Score: 8.3 6. CVE-2026-97678 - Description: Authenticated remote attackers can execute arbitrary code due to improper input validation. - CVSS Base Score: 8.8 7. CVE-2026-97673 - Description: Authenticated remote attackers can execute arbitrary code due to improper input validation. - CVSS Base Score: 8.8 8. CVE-2026-97655 - Description: Remote attackers can execute arbitrary code due to an incomplete block list in the code security scanner. - CVSS Base Score: 8.8 9. CVE-2026-97679 - Description: Authenticated remote attackers can execute arbitrary OS commands due to code injection caused by improper use of special elements. - CVSS Base Score: 8.8 10. CVE-2026-101331 - Description: Authenticated remote attackers can obtain sensitive information due to inadequate credential protection. - CVSS Base Score: 7.7 11. CVE-2026-97674 - Description: Authenticated remote attackers can execute arbitrary OS commands due to code injection caused by improper use of special elements. - CVSS Base Score: 8.1 12. CVE-2026-103360 - Description: Authenticated remote attackers can obtain sensitive information due to improper path restrictions. - CVSS Base Score: 8.1 13. CVE-2026-88962 - Description: Authenticated remote attackers can execute arbitrary code due to improper control of code generation. - CVSS Base Score: 8.8 14. CVE-2026-93674 - Description: Remote attackers can execute arbitrary code due to code injection caused by improper use of special elements. - CVSS Base Score: 9.8 15. CVE-2026-93679 - Description: Authenticated remote attackers can cause denial of service due to uncontrolled resource consumption during ZIP file extraction. - CVSS Base Score: 4.3 16. CVE-2026-93443 - Description: Authenticated remote attackers can execute arbitrary code due to code injection caused by improper use of special elements. - CVSS Base Score: 7.5 17. CVE-2026-93678 - Description: Authenticated remote attackers can obtain sensitive information due to improper authorization. - CVSS Base Score: 7.6 18. CVE-2026-93677 - Description: Authenticated remote attackers can obtain sensitive information due to exposure of sensitive information to unauthorized entities. - CVSS Base Score: 7.7 19. CVE-2026-93445 - Description: Authenticated remote attackers can execute arbitrary code due to improper control of code generation. - CVSS Base Score: 8.1 20. CVE-2026-93447 - Description: Attackers with server key and Redis write access can submit malicious serialized cache values to execute attacker-controlled code with service process privileges. - CVSS Base Score: 7.5 21. CVE-2026-93449 - Description: Authenticated remote attackers can execute arbitrary code due to improper control of code generation. - CVSS Base Score: 8.5 22. CVE-2026-93675 - Description: Remote attackers can execute arbitrary code due to expected dependency confusion. - CVSS Base Score: 8.8 23. CVE-2026-93448 - Description: Authenticated remote attackers can obtain sensitive information due to improper path restrictions. - CVSS Base Score: 6.5 24. CVE-2026-97671 - Description: Authenticated remote attackers can obtain sensitive information due to a path traversal vulnerability. - CVSS Base Score: 6.5 25. CVE-2026-104335 - Description: Authenticated remote attackers can execute arbitrary code due to improper access control. - CVSS Base Score: 8.8 Additional Information Document Number: 7290694 Last Modified: October 2, 2026 Initial Publication Date: Octob

Goal Reached Thanks to every supporter — we hit 100%!

Langflow OSS Multiple Vulnerabilities (RCE/CVE) Advisory 1.0.0-1.12.2