Advisory · CVE-2026-97676
Authenticated sandbox escape in Langflow leads to remote code execution
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker escape the code sandbox and execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97676
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow runs user code inside a padded playpen so it cannot hurt anything. This flaw lets a logged-in user climb out of the playpen and run code on the whole machine instead.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Crafted code elements
The attacker submits code containing special elements that Langflow fails to neutralize.
- 03Sandbox escape
The unneutralized elements let the code break out of the sandbox that was supposed to contain it.
- 04Arbitrary code runs
Attacker-controlled code executes outside the sandbox with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-97676 on October 7, 2026: a sandbox escape in IBM Langflow OSS versions 1.0.0 through 1.12.2. The product’s code sandbox is supposed to contain user-supplied code, but improper neutralization of special elements lets a remote authenticated attacker break out of it and execute arbitrary code on the host. IBM scores it high at CVSS 3.1 8.8, with full confidentiality, integrity, and availability impact.
Sandboxes are the main mitigation for the entire class of “run user code” features that make Langflow useful. When the sandbox itself fails, every flow that executes user code becomes a potential host compromise, including on multi-tenant instances where one tenant’s escape reaches other tenants’ data.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment, including shared and multi-tenant instances, and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts on shared instances.
- Review application and system logs for unusual code execution or unexpected host-level processes from low-privilege accounts.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems and neighboring tenants.
Management note
A broken sandbox removes the one assumption multi-tenant Langflow deployments rest on. Upgrade first, then review tenant isolation: code that escaped the sandbox could reach data it was never supposed to see.