CVE-2026-104308Medium· 4.3▾ SunlitIBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.
langflow_oss >= 1.0.0 <= 1.12.3IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.12.4. https://pypi.org/project/langflow/1.12.4/
For Langflow OSS versions 1.0.0 - 1.12.3, follow the Prepare to upgrade instructions and release-specific configuration changes https://docs.langflow.org/release-notes , including backing up your existing installation, then follow the Langflow OSS installation instructions https://docs.langflow.org/get-started-installation to install version 1.12.4 and test your flows.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104309Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-104316Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-104314Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-103092High· 8.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-77819Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-104310Medium· 4.3Langflow OSS is affected by multiple vulnerabilities