CVE-2026-7873: Langflow: Code Injection Vulnerability in Code Validation Endpoint

June 30, 2026 (updated October 23, 2026)

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

References

github.com/advisories/GHSA-v798-mcc6-2m3m
github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02
github.com/langflow-ai/langflow/pull/13696
github.com/langflow-ai/langflow/releases/tag/1.10.1.rc0
nvd.nist.gov/vuln/detail/CVE-2026-7873
www.ibm.com/support/pages/node/7278441

Code Behaviors & Features

Detect and mitigate CVE-2026-7873 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →