Vulnerability-Lookup

CVE-2026-9196 (GCVE-0-2026-9196)

Vulnerability from cvelistv5 – Published: 2026-08-05 18:27 – Updated: 2026-08-07 12:56

Title

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 03:55 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

ibm CNA under the mitre root

CNA scorecard B 88/100 over 1335 records in the last 180 days details

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7282646	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version	CPE status
IBM	Langflow OSS	Affected: 1.0.0 , ≤ 1.10.3 (semver) cpe:2.3:a:ibm:langflow_oss:1.0.0:::::::* cpe:2.3:a:ibm:langflow_oss:1.10.3:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T03:55:57.821807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T12:56:53.316Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*"
          ],
          "product": "Langflow OSS",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.\u003c/p\u003e"
            }
          ],
          "value": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T18:32:07.525Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7282646"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM recommends upgrading to Langflow OSS 1.11.0 or newer \u003ca href=\"https://github.com/langflow-ai/langflow/releases\" rel=\"nofollow\"\u003ehttps://github.com/langflow-ai/langflow/releases\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM recommends upgrading to Langflow OSS 1.11.0 or newer  https://github.com/langflow-ai/langflow/releases"
        }
      ],
      "title": "Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-9196",
    "datePublished": "2026-08-05T18:27:39.481Z",
    "dateReserved": "2026-05-21T15:28:16.679Z",
    "dateUpdated": "2026-08-07T12:56:53.316Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-9196",
      "date": "2026-11-05",
      "epss": "0.00527",
      "percentile": "0.44785"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*"
                ],
                "product": "Langflow OSS",
                "vendor": "IBM",
                "versions": [
                  {
                    "lessThanOrEqual": "1.10.3",
                    "status": "affected",
                    "version": "1.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@us.ibm.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9D820E7E-FD86-4EE6-9F29-E8DF9EC23F30",
                    "versionEndExcluding": "1.11.0",
                    "versionStartIncluding": "1.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process."
          },
          {
            "lang": "es",
            "value": "IBM Langflow OSS 1.0.0 hasta 1.10.3 podr\u00eda permitir a un atacante autenticado ejecutar c\u00f3digo no intencionado durante la validaci\u00f3n del Asistente Ag\u00e9ntico debido a un manejo inadecuado de los componentes generados por LLM. La aplicaci\u00f3n ejecuta c\u00f3digo Python generado por el modelo en el backend durante la validaci\u00f3n antes de la aprobaci\u00f3n del usuario, lo que podr\u00eda permitir a un atacante desencadenar efectos secundarios como acceso a la red saliente, interacci\u00f3n con el sistema de archivos o exfiltraci\u00f3n de datos con los privilegios del proceso de backend de Langflow."
          }
        ],
        "id": "CVE-2026-9196",
        "lastModified": "2026-10-24T13:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "psirt@us.ibm.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-9196",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T03:55:57.821807Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-05T19:17:48.523",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.ibm.com/support/pages/node/7282646"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-9196",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T03:55:57.821807Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-07T12:56:50.553Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*"
              ],
              "product": "Langflow OSS",
              "vendor": "IBM",
              "versions": [
                {
                  "lessThanOrEqual": "1.10.3",
                  "status": "affected",
                  "version": "1.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.\u003c/p\u003e"
                }
              ],
              "value": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T18:32:07.525Z",
            "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
            "shortName": "ibm"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "patch"
              ],
              "url": "https://www.ibm.com/support/pages/node/7282646"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIBM recommends upgrading to Langflow OSS 1.11.0 or newer \u003ca href=\"https://github.com/langflow-ai/langflow/releases\" rel=\"nofollow\"\u003ehttps://github.com/langflow-ai/langflow/releases\u003c/a\u003e\u003c/p\u003e"
                }
              ],
              "value": "IBM recommends upgrading to Langflow OSS 1.11.0 or newer  https://github.com/langflow-ai/langflow/releases"
            }
          ],
          "title": "Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "assignerShortName": "ibm",
        "cveId": "CVE-2026-9196",
        "datePublished": "2026-08-05T18:27:39.481Z",
        "dateReserved": "2026-05-21T15:28:16.679Z",
        "dateUpdated": "2026-08-07T12:56:53.316Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2026-32369

Vulnerability from cnvd - Published: 2026-08-18

Title

IBM Langflow OSS代码执行漏洞（CNVD-2026-32369）

Description

IBM Langflow OSS是IBM官方集成并推广使用的‌Langflow开源版本。 IBM Langflow OSS存在代码执行漏洞，该漏洞源于在Agentic Assistant验证期间未能正确处理LLM生成的组件，后端在用户批准前即执行模型生成的Python代码，攻击者可利用该漏洞以Langflow后端进程权限触发副作用，如出站网络访问、文件系统交互或数据泄露。

Severity

高

Patch Name

IBM Langflow OSS代码执行漏洞（CNVD-2026-32369）的补丁

Patch Description

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://www.ibm.com/support/pages/node/7282646

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-9196

Impacted products

Name
IBM Langflow OSS >=1.0.0，<=1.10.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-9196",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-9196"
    }
  },
  "description": "IBM Langflow OSS\u662fIBM\u5b98\u65b9\u96c6\u6210\u5e76\u63a8\u5e7f\u4f7f\u7528\u7684\u200cLangflow\u5f00\u6e90\u7248\u672c\u3002\n\nIBM Langflow OSS\u5b58\u5728\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Agentic Assistant\u9a8c\u8bc1\u671f\u95f4\u672a\u80fd\u6b63\u786e\u5904\u7406LLM\u751f\u6210\u7684\u7ec4\u4ef6\uff0c\u540e\u7aef\u5728\u7528\u6237\u6279\u51c6\u524d\u5373\u6267\u884c\u6a21\u578b\u751f\u6210\u7684Python\u4ee3\u7801\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5Langflow\u540e\u7aef\u8fdb\u7a0b\u6743\u9650\u89e6\u53d1\u526f\u4f5c\u7528\uff0c\u5982\u51fa\u7ad9\u7f51\u7edc\u8bbf\u95ee\u3001\u6587\u4ef6\u7cfb\u7edf\u4ea4\u4e92\u6216\u6570\u636e\u6cc4\u9732\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://www.ibm.com/support/pages/node/7282646",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-32369",
  "openTime": "2026-08-18",
  "patchDescription": "IBM Langflow OSS\u662fIBM\u5b98\u65b9\u96c6\u6210\u5e76\u63a8\u5e7f\u4f7f\u7528\u7684\u200cLangflow\u5f00\u6e90\u7248\u672c\u3002\r\n\r\nIBM Langflow OSS\u5b58\u5728\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Agentic Assistant\u9a8c\u8bc1\u671f\u95f4\u672a\u80fd\u6b63\u786e\u5904\u7406LLM\u751f\u6210\u7684\u7ec4\u4ef6\uff0c\u540e\u7aef\u5728\u7528\u6237\u6279\u51c6\u524d\u5373\u6267\u884c\u6a21\u578b\u751f\u6210\u7684Python\u4ee3\u7801\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5Langflow\u540e\u7aef\u8fdb\u7a0b\u6743\u9650\u89e6\u53d1\u526f\u4f5c\u7528\uff0c\u5982\u51fa\u7ad9\u7f51\u7edc\u8bbf\u95ee\u3001\u6587\u4ef6\u7cfb\u7edf\u4ea4\u4e92\u6216\u6570\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Langflow OSS\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2026-32369\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "IBM Langflow OSS \u003e=1.0.0\uff0c\u003c=1.10.3"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-9196",
  "serverity": "\u9ad8",
  "submitTime": "2026-08-06",
  "title": "IBM Langflow OSS\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2026-32369\uff09"
}

FKIE_CVE-2026-9196

Vulnerability from fkie_nvd - Published: 2026-08-05 19:17 - Updated: 2026-10-24 13:10

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7282646	Vendor Advisory

Impacted products

	Vendor	Product	Version
	langflow	langflow	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*"
          ],
          "product": "Langflow OSS",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D820E7E-FD86-4EE6-9F29-E8DF9EC23F30",
              "versionEndExcluding": "1.11.0",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process."
    },
    {
      "lang": "es",
      "value": "IBM Langflow OSS 1.0.0 hasta 1.10.3 podr\u00eda permitir a un atacante autenticado ejecutar c\u00f3digo no intencionado durante la validaci\u00f3n del Asistente Ag\u00e9ntico debido a un manejo inadecuado de los componentes generados por LLM. La aplicaci\u00f3n ejecuta c\u00f3digo Python generado por el modelo en el backend durante la validaci\u00f3n antes de la aprobaci\u00f3n del usuario, lo que podr\u00eda permitir a un atacante desencadenar efectos secundarios como acceso a la red saliente, interacci\u00f3n con el sistema de archivos o exfiltraci\u00f3n de datos con los privilegios del proceso de backend de Langflow."
    }
  ],
  "id": "CVE-2026-9196",
  "lastModified": "2026-10-24T13:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9196",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-06T03:55:57.821807Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-05T19:17:48.523",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7282646"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4Q62-CJ5W-QMFX

Vulnerability from github – Published: 2026-08-05 21:31 – Updated: 2026-08-06 21:31

Details

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-9196"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T19:17:48Z",
    "severity": "HIGH"
  },
  "details": "IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM\u2011generated components. The application executes model\u2011generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.",
  "id": "GHSA-4q62-cj5w-qmfx",
  "modified": "2026-08-06T21:31:34Z",
  "published": "2026-08-05T21:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9196"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7282646"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-9196 (GCVE-0-2026-9196)

CNVD-2026-32369

FKIE_CVE-2026-9196

GHSA-4Q62-CJ5W-QMFX

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour