{"id":"CVE-2026-104339","aliases":[],"cve":{"records":[{"id":"CVE-2026-104339","source":"ibm","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-01T20:11:04.958Z","published":"2026-10-29T15:16:38.628Z","modified":"2026-10-30T03:56:26.674Z"}],"publishers":[{"name":"ibm","role":"CNA","organizationId":"9a959283-ebb5-44b6-b705-dcc2bbced522","modified":"2026-10-29T15:16:38.628Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T03:56:26.674Z"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","tags":["vendor-advisory","patch"],"source":"ibm"}],"weaknesses":[{"id":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","source":"ibm"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Langflow OSS is affected by multiple vulnerabilities","titleSource":"ibm","descriptionSource":"ibm","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","score":9.8,"severity":"critical","published":"2026-10-29T15:16:38.628Z","modified":"2026-10-30T03:56:26.674Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"IBM","name":"Langflow OSS","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.12.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-104339"}],"remediation":[{"text":"IBM strongly recommends addressing the vulnerability now by upgrading  Langflow OSS to version 1.12.4. https://pypi.org/project/langflow/1.12.4/ \n\n\n\nFor Langflow OSS versions 1.0.0 - 1.12.3, follow the  Prepare to upgrade instructions and release-specific configuration changes https://docs.langflow.org/release-notes , including backing up your existing installation, then follow the  Langflow OSS installation instructions https://docs.langflow.org/get-started-installation  to install version 1.12.4 and test your flows.","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-104339"}],"references":["https://www.ibm.com/support/pages/node/7293015"],"sources":[{"name":"CVE","id":"CVE-2026-104339","modified":"2026-10-30T03:56:26.674Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-104339"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-10-30T04:20:04.422Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:10:31.776Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T19:45:39.596Z","attemptedAt":"2026-10-29T19:45:39.596Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T19:45:38.581Z","attemptedAt":"2026-10-29T19:45:38.581Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T19:45:39.165Z","attemptedAt":"2026-10-29T19:45:39.165Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T19:45:38.581Z","attemptedAt":"2026-10-29T19:45:38.581Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-8rq9-23x9-43h7","url":"https://github.com/advisories/GHSA-8rq9-23x9-43h7","modified":"2026-10-29T18:30:55Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T19:45:38.581Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113139","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113139","modified":"Oct 29, 2026, 6:30:50 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T19:45:39.165Z"},{"source":"NVD","id":"CVE-2026-104339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104339","modified":"2026-10-29T16:17:44.497","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-29T19:45:39.596Z"}],"aiSummary":{"text":"IBM Langflow OSS versions 1.0.0 through 1.12.3 may allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. The vulnerability is described as improper control of generation of code. The impact is stated as execution of arbitrary code.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:02:10.346Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-104339"}]}}