CVE-2026-6543
Command Injection in IBM Langflow Desktop
Publication date: 2026-04-30
Last updated on: 2026-04-30
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | langflow | From 1.0.0 (inc) to 1.8.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in IBM Langflow Desktop versions 1.0.0 through 1.8.4 allows an attacker to execute arbitrary commands with the same privileges as the Langflow process.
This means the attacker can read sensitive environment variables such as API keys and database credentials, modify files, or launch further attacks on the internal network.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive information like API keys and database credentials.
An attacker could modify important files or use the compromised system as a foothold to launch additional attacks within the internal network.
Overall, it can lead to data breaches, system compromise, and disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to execute arbitrary commands with the privileges of the Langflow process, potentially leading to unauthorized access to sensitive environment variables such as API keys and database credentials. Such unauthorized access and potential data exposure can result in violations of data protection requirements under common standards and regulations like GDPR and HIPAA.
Specifically, the compromise of sensitive information and the ability to modify files or launch further attacks on the internal network could lead to breaches of confidentiality, integrity, and availability, which are core principles in these regulations.