CVE-2026-93674
Remote code execution in Langflow OSS via OS command injection
Langflow OSS versions 1.0.0 through 1.12.2 contain an OS command injection vulnerability. A remote attacker can exploit this to execute arbitrary code on the affected system. No fix has been released, and there is no known active exploitation.
IBM Langflow OSS · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fix is available. No workaround has been provided by IBM. Monitor vendor announcements for updates.
What happened
- 23 OctRapid7 reported Langflow in its Metasploit Wrap Up.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-93674 | Langflow OSS is affected by multiple vulnerabilities | critical 9.8 | No | 15% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Rapid7 · 23 OctMetasploit Wrap Up: Langflow, MongoDB, and More ↗The records
ibm.com: advisory ↗CVE-2026-93674 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works