IBM Langflow OSS is impacted by a critical code injection vulnerability that allows authenticated attackers to execute arbitrary code on the system.

This is a Code Injection (CWE-94) vulnerability where user-provided input is not properly controlled before being processed as code. The attack requires low privileges, meaning an attacker must have an authenticated session to trigger the flaw.

With a CVSS score of 9.9, this vulnerability presents a severe risk. While it requires authentication, the impact on confidentiality, integrity, and availability is total, potentially allowing an attacker to escape the application context and compromise the underlying server infrastructure.

Immediate Action: Upgrade IBM Langflow OSS to version 1.10.1 or higher to address the improper control of user input.

Proactive Monitoring: Audit user account activity and review application logs for signs of unauthorized code execution or attempts to manipulate application logic.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to minimize the number of users who can interact with the vulnerable features until the patch is applied.

Public Exploit Available: No

Organizations must enforce strict access controls and prioritize the update to version 1.10.1. By limiting the pool of authenticated users and applying the latest vendor patches, the risk of exploitation is significantly reduced.