Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Remote Code Execution in CUGA Component CodeAgent in IBM Langflow OSS

CVE-2026-12946 · published 1 month ago
Summary

IBM Langflow OSS versions 1.0.0 to 1.10.0 have a security weakness. An attacker can potentially inject malicious code on your system, which could lead to unauthorized access or data compromise. Update your software to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm langflow oss <= 1.10.0
Original advisory text
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published30 Jul 2026
Updated25 Sep 2026
First seen30 Jul 2026
Sources
CVE-2026-12946 · NVD
CVE-2026-12946 · MITRE
CVE-2026-12946 · OSV
Track software like this
Free during beta