CVE-2026-19295

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1

Description An authenticated attacker can execute arbitrary operating system commands within the server process. This occurs by saving a flow containing a crafted value in the type field and subsequently triggering a build of a wrapper flow that references it. This flaw enables privilege escalation from an authenticated flow user to OS-level command execution under the server process identity, effectively bypassing the LANGFLOW ALLOW CUSTOM COMPONENTS=false policy control.

Recommendations Update IBM Langflow OSS to a version later than 1.11.1.