CVE-2026-104339

Summary

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a command injection vulnerability (CWE-94) where unsanitized user input is passed to an OS command, enabling remote code execution without authentication.

Exploitability

Exploitation is straightforward for remote attackers due to the CVSS vector indicating no authentication, no user interaction, and low attack complexity.

Blast radius

Successful exploitation would allow full system compromise including data theft, malware deployment, and lateral movement within the affected environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Langflow OSS version 1.12.4 or later, as this is the first fixed version addressing CVE-2026-104339.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.