CVE-2026-107329

Summary

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection flaw (CWE-94) where an authenticated attacker can execute arbitrary code due to improper control of code generation, leading to full system compromise.

Exploitability

Exploitation requires valid authentication and low privilege access, with no user interaction needed; difficulty is moderate due to the direct code execution path.

Blast radius

Successful exploitation allows full compromise of confidentiality, integrity, and availability of the affected system and potentially downstream services if Langflow integrates with other components.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Langflow OSS version 1.12.5 or later, as this is the first fixed version addressing the code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.