Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

IBM Langflow Python Sandbox Bypass Exposes Sensitive Data

CVE-2026-13435 · published 1 month ago
Summary

IBM Langflow's Python sandbox feature has a weakness that could allow an attacker to access sensitive information. This affects users who rely on Langflow's Python integration, particularly those who store confidential data within the system. To protect against this, update to a fixed version of Langflow as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm langflow oss <= 1.10.1
Original advisory text
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published30 Jul 2026
Updated25 Sep 2026
First seen30 Jul 2026
Sources
CVE-2026-13435 · NVD
CVE-2026-13435 · MITRE
CVE-2026-13435 · OSV
Track software like this
Free during beta