CVE-2026-19295

langflow

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-19295

Katalog CVE

CVSS 9.9 · Critical EPSS 3,0%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada langflow. Skor CVSS 3.1 9.9 (Critical) menurut us.ibm.com.

Deskripsi (NVD)

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

Rincian

Terbit di NVD
28 Agustus 2026
Terakhir diubah
1 September 2026
Status NVD
Analyzed
CVSS 3.1
9.9 (Critical), sumber us.ibm.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
EPSS (30 hari)
3,0% peluang dieksploitasi; lebih tinggi dari 87,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
langflow langflow Versi 1.0.0 hingga sebelum 1.11.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.