High priorityDisclosed

Advisory · CVE-2026-97674

Authenticated OS command injection in Langflow

Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 8.1.

Advisory published October 7, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-97674
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Once logged in, a user can smuggle extra computer commands inside an ordinary Langflow request, because Langflow does not scrub the request before handing it to the computer's command line. The computer runs the smuggled commands.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    A remote attacker authenticates to Langflow with valid, low-privilege credentials.

  2. 02Crafted input

    The attacker submits input containing special OS command elements that Langflow fails to neutralize.

  3. 03Command assembly

    Langflow builds an OS command incorporating the attacker-controlled input.

  4. 04Command execution

    The operating system runs the attacker's commands with the privileges of the Langflow service process.

What happened

IBM disclosed CVE-2026-97674 on October 7, 2026: an OS command injection flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote authenticated attacker can smuggle special elements past Langflow’s input handling into an OS command the product builds, reaching arbitrary OS command execution. IBM scores it high at CVSS 3.1 8.1, with confidentiality and integrity impacted.

OS command injection hands the attacker the host shell rather than just application-level execution, which makes post-exploitation straightforward: read files, exfiltrate secrets, and pivot from a host that often holds cloud credentials for AI workloads.

IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.

What to do

  1. Inventory every Langflow deployment and confirm the running version.
  2. Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
  3. Until patched, restrict network access to Langflow and review who holds accounts.
  4. Review host and application logs for unexpected spawned processes, shell invocations, or outbound connections from the Langflow host.
  5. If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.

Management note

Shell access on a host that wires AI flows to APIs and cloud credentials is a credential-harvesting opportunity. Treat host logs as the record that matters here, not just the application log.