CVE-2026-12946

CriticalCVSS 9.9

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, potentially leading to full system and data compromise.

Recommendation

Update IBM Langflow OSS to version 1.10.1 or later which contains the fix.

Original NVD description (English source)

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.