AI analysis
IBM Langflow OSS 1.0.0 through 1.11.1 contains a command/code injection flaw (CWE-95) in which a user-supplied 'type' field value in a saved flow is not neutralized when it is used during a flow build. An authenticated user can save a flow with a crafted type field value and then trigger a build of a wrapper flow that references it, causing the server process to execute attacker-controlled operating system commands. This escalates privileges from a restricted 'authenticated flow user' to arbitrary OS-level command execution running under the Langflow server process identity, and it works even when administrators have disabled custom components via LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false. Any deployment running the affected versions is exposed, with the greatest risk where untrusted users can create or edit flows or where the server is network-reachable. Exploitation has not been observed: there is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS currently gives it a 1% probability of exploitation in the next 30 days.
What to do: Upgrade all Langflow OSS instances in the 1.0.0-1.11.1 range to the first patched release after 1.11.1, per IBM's advisory. Until patched, restrict who can save or create flows to trusted users and avoid exposing the server to the internet, and note that setting LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false does not prevent this flaw. Audit saved flows for unexpected 'type' field values and review what privileges the Langflow service account holds on the host.
Affected
| IBM Langflow OSS | 1.0.0 through 1.11.1 (inclusive) |
Estimated exposure
largetens of thousands of deployments (roughly 1k-10k directly internet-exposed) — Estimate based on Langflow's position as one of the most widely adopted open-source LLM workflow builders (tens of thousands of GitHub stars and millions of cumulative Docker pulls), typically self-hosted by AI development teams inside…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.