Security Vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
CVSS Score
8.8
EPSS Score
0.006
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.
CVSS Score
7.5
EPSS Score
0.004
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
CVSS Score
9.8
EPSS Score
0.006
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.
CVSS Score
6.5
EPSS Score
0.004
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVSS Score
8.8
EPSS Score
0.007
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
CVSS Score
9.9
EPSS Score
0.007
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
CVSS Score
9.9
EPSS Score
0.009
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
CVSS Score
9.9
EPSS Score
0.009
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
CVSS Score
8.8
EPSS Score
0.007
Published
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVSS Score
8.8
EPSS Score
0.007
Published
2026-10-29