by Kastro
Paper/Archive/CVE-2026-7873

CVE-2026-7873

IBM Langflow OSS — Code Injection Vulnerability in Code Validation Endpoint

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 75.1.751 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

Affected

ProductAffectedFixed inSource
Langflow OSS1.0.0 – 1.10.0–CNA

Scores by source

ibm (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchibm.com/support/pages/node/7278441