IBM Langflow OSS: Arbitrary code execution via eval/exec (CVE-2026-107328)
IBM Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to remote code execution due to improper neutralization of code in eval/exec functions by a remote authenticated attacker.
CVE search metadata
CVE search record: CVE-2026-107328. Severity: critical. CVSS: 9.9. KEV: no. Product: Langflow OSS (1.0.0 through 1.12.4). Brief: IBM Langflow OSS: Arbitrary code execution via eval/exec (CVE-2026-107328). Brief link: https://feed.craftedsignal.io/briefs/2026-10-langflow-rce/
CVE search record: CVE-2026-107327. Severity: critical. CVSS: 9.9. KEV: no. Product: Langflow OSS (1.0.0 through 1.12.4). Brief: IBM Langflow OSS: Arbitrary code execution via eval/exec (CVE-2026-107328). Brief link: https://feed.craftedsignal.io/briefs/2026-10-langflow-rce/
Triage facts
Revision 2- Applicability
- Langflow OSS (1.0.0 through 1.12.4)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 29, 18:44 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
added CVE-2026-107327
Changed: cves, lastmod, references, updates
Sources: 1
IBM Langflow OSS versions 1.0.0 through 1.12.4 allow a remote authenticated attacker to execute arbitrary code. This vulnerability is caused by improper neutralization of code in eval/exec.