Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76059

Langflow OSS · Vulnerability

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76059

Published

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76059

Published

Langflow OSS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Langflow OSS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0",
                            "lessThanOrEqual": "1.11.5",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:langflow_oss:1.11.5:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON