Advisory · CVE-2026-93445
Authenticated code execution in Langflow through unneutralized code elements
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.1.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-93445
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow lets logged-in users write descriptions that get turned into working code, but it forgets to scrub the dangerous characters first. A user can hide instructions in their description, and Langflow runs them.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Crafted code elements
The attacker submits input containing special elements that Langflow fails to neutralize.
- 03Injection into code
The unneutralized elements break out of their intended context inside generated or evaluated code.
- 04Arbitrary code runs
Attacker-controlled code executes with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-93445 on October 7, 2026: an improper neutralization of special elements used in code in IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote authenticated attacker can inject elements that escape their intended context inside code the product builds or evaluates, reaching arbitrary code execution. IBM scores it high at CVSS 3.1 8.1, with confidentiality and integrity impacted.
It is one entry in a bulletin of sibling Langflow flaws that share a theme: user-influenced input reaching code execution contexts with insufficient scrubbing. The pattern repeats across endpoints, so the remediation is the same everywhere: upgrade.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts.
- Review application and system logs for unusual flow execution or code execution calls from low-privilege accounts.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
This is a pattern flaw, not a one-off: the same bulletin carries several siblings with the same shape. Patch once, patch everywhere, and audit which accounts on shared instances could have reached these endpoints before the fix.