IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a critical code injection vulnerability that allows authenticated attackers to execute arbitrary code on the host system.

This vulnerability is classified as CWE-94, which involves the improper control of code generation. A remote attacker with authenticated access can leverage this flaw to inject and execute arbitrary code within the application environment.

The ability for an authenticated user to perform remote code execution poses a severe risk to the confidentiality, integrity, and availability of the affected system. With a CVSS score of 8.8, this high severity vulnerability could lead to a complete system compromise, unauthorized data access, and potential lateral movement within the network. Organizations relying on Langflow OSS for workflow automation should consider this a priority security concern.

Immediate Action: Upgrade IBM Langflow OSS to version 1.11.2 or later as provided in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual command execution patterns or anomalous user activity originating from authenticated accounts.

Compensating Controls: Implement strict network segmentation and apply the principle of least privilege to limit the impact of a compromised account.

Public Exploit Available: No — exploit_available (false).

Given the high CVSS score and the potential for full remote code execution, it is imperative that administrators prioritize the update to version 1.11.2 immediately. Ensure that all instances of Langflow OSS are accounted for in the update cycle to eliminate this vector for unauthorized system control.