PT-2026-83334
CVE-2026-19295
·
تاريخ النشر
2026-08-24
·
تاريخ التحديث
2026-09-01
الوصف من
CVSS 3.1
9.9
حرجةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
IBM Langflow OSS versions 1.0.0 through 1.11.1
Description
An authenticated attacker can execute arbitrary operating system commands within the server process. This occurs by saving a flow containing a crafted value in the
type field and subsequently triggering a build of a wrapper flow that references it. This flaw enables privilege escalation from an authenticated flow user to OS-level command execution under the server process identity, effectively bypassing the LANGFLOW ALLOW CUSTOM COMPONENTS=false policy control.Recommendations
Update IBM Langflow OSS to a version later than 1.11.1.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾