High priorityDisclosed

Advisory · CVE-2026-101288

Authenticated remote code execution in Langflow via code neutralization

IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker execute arbitrary code due to improper neutralization of special elements used in code. IBM rates it high at CVSS 8.8.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-101288
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow builds code from user input but does not clean out the dangerous characters first. An authenticated attacker hides their own instructions in that input and the server runs them.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote attacker holds any authenticated Langflow account.

  2. 02Special elements not neutralized

    Attacker input carrying code-significant characters reaches code handling uncleaned.

  3. 03Arbitrary code execution

    The attacker code runs on the Langflow host.

What happened

IBM disclosed CVE-2026-101288 in Langflow OSS versions 1.0.0 through 1.12.3: a remote authenticated attacker can execute arbitrary code due to improper neutralization of special elements used in code. IBM rates it high at CVSS 3.1 8.8, with low privileges required and no user interaction.

IBM directs users to upgrade to Langflow OSS 1.12.5, which covers the flaws in this bulletin.

What to do

  1. Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow while patching.
  4. Review application and host logs for unusual authenticated activity and unexpected processes.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

Patch with the rest of the Langflow bulletin. Authenticated RCE in an AI builder should not wait for a maintenance window.