A code injection vulnerability in IBM Langflow OSS allows authenticated attackers to execute arbitrary commands, posing a high risk to system integrity.

This vulnerability is a CWE-94: Improper Control of Generation of Code (Code Injection) flaw. It requires an attacker to have low-level authenticated access to the application to successfully trigger the injection.

Successful exploitation allows an attacker to execute arbitrary code within the context of the application, potentially leading to full system compromise. Given the CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and integrity, as attackers could manipulate system behavior or exfiltrate sensitive information.

Immediate Action: Upgrade to Langflow OSS version 1.11.0 or newer as specified in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual patterns, particularly those originating from user accounts that involve complex payloads or suspicious input strings.

Compensating Controls: Implement strict input validation and utilize a Web Application Firewall to filter out common code injection sequences before they reach the application.

Public Exploit Available: false

The severity of this vulnerability is high, and the potential for unauthorized code execution necessitates immediate attention. Organizations currently running versions 1.0.0 through 1.10.3 should prioritize the upgrade to version 1.11.0 to eliminate the injection risk.