Advisory · CVE-2026-97679
Authenticated OS command injection in Langflow tied to input validation
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through code injection rooted in improper input validation. IBM rates it high at CVSS 8.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97679
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow builds computer commands from what logged-in users type, and its spell-check for dangerous characters misses some. A user can hide an extra command in their typing, and the computer runs it without asking.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Poorly validated input
The attacker submits input that Langflow's validation does not properly check for OS command elements.
- 03Command injection
The unchecked input is incorporated into an OS command, breaking out of its intended context.
- 04Command execution
The operating system runs the attacker's commands with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-97679 on October 7, 2026: a code injection flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2 that reaches arbitrary OS command execution, rooted in improper input validation. Special elements used in an OS command are not neutralized, so a remote authenticated attacker can break out of the intended command context. IBM scores it high at CVSS 3.1 8.8, with full confidentiality, integrity, and availability impact.
The validation root cause matters for defenders: this is not just one missed check but input handling that was never designed to distrust its input. Any input path that feeds OS commands in these versions should be treated as suspect until the product is upgraded.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts.
- Review host and application logs for unexpected spawned processes, shell invocations, or outbound connections from the Langflow host.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
When the root cause is input validation, the vulnerable surface is every input the product accepts, not one endpoint. The upgrade is the fix, and a review of shell and process logs on the host is the check that the fix came in time.