Advisory · CVE-2026-93674
Unauthenticated OS command injection in Langflow
Langflow OSS releases 1.0.0 through 1.12.2 let a remote, unauthenticated attacker run arbitrary OS commands through improper neutralization of special elements in an OS command. IBM rates it critical at CVSS 9.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-93674
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow passes parts of what visitors type straight to the computer's command line without scrubbing them. A stranger can smuggle an extra command in with their message, and the computer obeys both.
- 01Network reach
A remote attacker reaches the Langflow server over the network without any credentials.
- 02Crafted input
The attacker submits input containing special command-line elements that Langflow fails to neutralize.
- 03Command assembly
Langflow builds an OS command incorporating the attacker-controlled input.
- 04Command execution
The operating system runs the attacker's commands with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-93674 on October 7, 2026: an OS command injection flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2. The product fails to neutralize special elements used in an OS command, letting attacker input break out of its intended command context. IBM scores it critical at CVSS 3.1 9.8, with network access, no privileges required, and no user interaction.
Unlike the sibling code generation flaws in the same bulletin, this one reaches the host’s command shell directly, so successful exploitation hands the attacker OS-level command execution on the Langflow host rather than just application-level code running.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment, including self-hosted, demo, research, and individually managed cloud instances, and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow, keep it off the public internet, and require authentication everywhere.
- Review host and application logs for unexpected spawned processes, shell invocations, or outbound connections from the Langflow host.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
A 9.8 OS command injection with no authentication is a pre-authenticated shell on the host. Prioritize this alongside the sibling critical: any internet-facing Langflow instance from this version range should be treated as potentially compromised until logs and patching say otherwise.