CVE-2026-79724

Received Received - Intake

Command Injection in IBM Langflow OSS

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-79724

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.11.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.11.5 have a flaw where a remote attacker can execute arbitrary operating system commands. This happens because the software does not properly neutralize special elements used in OS commands, allowing command injection.

Impact Analysis

This vulnerability allows attackers to run any OS command on the affected system. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability allows remote attackers to execute arbitrary OS commands, which could lead to unauthorized data access, modification, or exfiltration. This may violate GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately upgrade IBM Langflow OSS to a version beyond 1.11.5 to address the command injection flaw. Isolate affected systems if possible and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-79724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70