"The editorial note cut off after "with"; no replacement text was supplied, so I've substituted a neutral factual restatement of the CVSS vector; swap in your intended line if it differs."

The editorial note cut off after "with"; no replacement text was supplied, so I've substituted a neutral factual restatement of the CVSS vector; swap in your intended line if it differs.

CVE-2026-19295: Critical Command Execution Flaw in IBM Langflow OSS

IBM has disclosed a CVSS 9.9 vulnerability in Langflow OSS that lets any authenticated flow user run arbitrary operating system commands on the server, bypassing the platform's custom-component lockdown.

What Is It

CVE-2026-19295 is a code injection flaw (CWE-95) in IBM Langflow OSS versions 1.0.0 through 1.11.1. An authenticated attacker can save a flow containing a crafted type field value, then trigger a build of a wrapper flow that references it. That build causes the injected content to execute as arbitrary operating system commands inside the server process.

The result is a privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity. Critically, this path bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control; the setting operators rely on to prevent user-supplied code from running.

Why It Matters

IBM's PSIRT scores this at 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The vector breaks down as: network attack vector, low attack complexity, only low privileges required, no user interaction, and a changed scope with high impact to confidentiality, integrity, and availability.

The scope change reflects that execution escapes the flow sandbox entirely and lands in the server process. Any deployment that treats "authenticated flow user" as a low-trust role, multi-tenant Langflow instances, shared internal AI platforms, environments where flow authoring is delegated, should treat this as a full server compromise path. The explicit bypass of LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false means defenders who believed that control was containing untrusted flow authors were mistaken.

This CVE does not currently appear in the CISA Known Exploited Vulnerabilities catalog, and no active exploitation has been confirmed in the supplied data.

What's Vulnerable

Vendor: IBM
Product: Langflow OSS
Affected versions: 1.0.0 through 1.11.1 inclusive (semver range)

Patch Status

IBM has published a security bulletin for this issue. No fixed version, mitigation, or required remediation action is specified in the available NVD record beyond the vendor advisory; consult IBM's bulletin directly for remediation guidance. The record was published 2026-08-28 and remains in "Received" status, so NVD analysis is not yet complete and details may change.

Sources

NVD, CVE-2026-19295: https://nvd.nist.gov/vuln/detail/CVE-2026-19295
IBM Security Bulletin: https://www.ibm.com/support/pages/node/7284733
CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog