CVE-2026-76059

Received Received - Intake

Command Injection in IBM Langflow OSS

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-76059

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.11.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an attacker to bypass security checks by submitting malicious component code. The flaw occurs when custom code uses specific syntax that tricks the static scanner into missing dangerous commands. If the component executes, it can run arbitrary OS commands on the server with the service's privileges.

Detection Guidance

Detecting this vulnerability requires inspecting IBM Langflow OSS instances for custom components with crafted class-body assignments. Check logs for unusual command execution patterns or components bypassing static security scans. No specific commands are provided in the context.

Impact Analysis

If you use IBM Langflow OSS in your environment, an attacker could exploit this to execute malicious commands on your server. This could lead to data theft, system compromise, or unauthorized access to sensitive resources. The impact depends on the service's privileges and your system configuration.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data breaches or loss of control over systems handling sensitive data. Organizations may face penalties or audit failures if this flaw is exploited due to inadequate security controls.

Mitigation Strategies

Upgrade IBM Langflow OSS to a version beyond 1.11.5 to address the static security scanner bypass and arbitrary command execution flaw. Review custom component source code for suspicious annotations or alias tracking that could bypass security checks.

Hi! I’m here to help you understand CVE-2026-76059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70