CVE-2026-13448

Katalog CVE

CVSS 9.8 · Critical EPSS 0,67%

Kerentanan Incomplete List of Disallowed Inputs pada langflow. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

23 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.ibm.com/support/pages/node/7279997 advisory vendor