CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a protection-mechanism failure (CWE-693) in the static security scanner that vets custom components before they are executed. A user who can submit custom component source code can craft an annotated class-body assignment that resolves, through alias tracking, to a dangerous callable; due to a logic error, the resolved value is never checked against the dangerous-callable blocklist, so the malicious component passes the scanner. If the crafted component then reaches the runtime execution path, the attacker's code runs in-process on the server and can execute arbitrary operating-system commands with the privileges of the running Langflow service. Any deployment in which untrusted or semi-trusted users can create or import custom components is affected, including multi-user and internet-exposed instances. No public proof-of-concept is known and the issue is not in CISA's KEV, so exploitation is not currently observed.

What to do: Upgrade Langflow to a patched release (any version after 1.11.5) once IBM publishes the fix, and verify no unpatched instances remain in your environment. Until then, restrict custom component creation/import to trusted users and review recently added components for annotated class-body assignments whose values resolve through aliases to dangerous callables. Run the Langflow service with least privilege and isolate it from sensitive hosts, since exploitation executes OS commands in-process with the service's privileges.