Patch Forecast
Amber warning
Patch this week.

CVE-2026-97679

Langflow: code injection can lead to remote code execution

Risk score
60/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.4%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
Affected
Langflow
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: LangflowTHE FLAWSTHE FIXCVE-2026-97679Code injection can lead toremote code executionCVSS 8.8 · EPSS 0%CVE-2026-93674Code injection can lead toremote code executionCVSS 9.8 · EPSS 6%CVE-2026-8505Langflow: UnauthenticatedFlow Execution via WebhookAuthentication BypassCVSS 9.8 · EPSS 1%CVE-2026-93675Remote code executionCVSS 9.8 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLangflowRED · ACT TODAYLangflowIBM Langflow OSS 1.0.0 through1.12.2 could allow a remoteattacker to execute arbitrarycode due to improperneutralization of specialelements used in an OS command.Where it standsNo known exploitationCONNECTS TOSame weaknessCode injection (CWE-94)238 other warnings in 30 days →Same productEarlier Langflow warnings22 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Langflow: Red, act today. IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

The flaws

  • CVE-2026-97679: Code injection can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-93674: Code injection can lead to remote code execution (CVSS 9.8 · EPSS 6%)
  • CVE-2026-8505: Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass (CVSS 9.8 · EPSS 1%)
  • CVE-2026-93675: Remote code execution (CVSS 9.8 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Langflow

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high

References

Original description

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.

Last activity 7 Oct 2026. Patch Forecast updates every hour.