Advisory · CVE-2026-93675
Remote code execution in Langflow through dependency confusion
Langflow OSS releases 1.0.0 through 1.12.2 let a remote attacker execute arbitrary code through a dependency confusion flaw. IBM rates it high at CVSS 8.8; no authentication is required, only a user action such as installing or updating.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-93675
CWE-440 - Action timing
- Immediate
Explain it like I’m five
Langflow asks the internet for spare parts by name. An attacker can register a part with the same name but containing a trap, and Langflow picks up the trap instead of the real part. When someone installs it, the trap runs.
- 01Attacker package
An attacker publishes a malicious package under a dependency name Langflow resolves to a public registry.
- 02Resolution
Langflow's dependency resolution is expected to select the attacker's package instead of the intended one.
- 03User action
A user or automation performs an install, update, or related action that pulls the resolved dependency.
- 04Malicious code runs
The attacker's code executes on the host with the privileges of the process performing the install.
What happened
IBM disclosed CVE-2026-93675 on October 7, 2026: an expected dependency confusion flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote attacker who can influence which dependency package gets resolved can substitute a malicious one, and the next install or update action executes the attacker’s code. No authentication is required on the Langflow side; the trigger is a user or automation action such as installing or updating. IBM scores it high at CVSS 3.1 8.8.
Dependency confusion is a supply chain flaw: the attack runs before any Langflow application logic is involved, and it can compromise the build or deployment pipeline that prepares the Langflow environment rather than just the running instance.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory Langflow deployments and the pipelines that install, update, or build them.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Pin and verify dependencies in install and build pipelines: lockfiles, hash verification, and private registry priority over public registries.
- Review install, update, and build logs for unexpected packages or registry sources around the time of deployment.
- If a suspicious dependency cannot be excluded, treat the build host and its artifacts as compromised and rebuild from trusted sources.
Management note
This one targets the supply chain, not the running app: patching the instance without auditing the install pipeline leaves the same trap armed for the next deploy. Verify what got installed where, then upgrade.