CVE-2026-93443 is a code injection flaw in IBM Langflow OSS 1.0.0 through 1.12.2 that could let a remote, authenticated attacker run arbitrary code. NVD and IBM both score it High (7.5). IBM recommends upgrading to Langflow OSS 1.12.3.
What's affected
IBM's bulletin, first published 2 October 2026, lists Langflow OSS 1.0.0 through 1.12.2 as affected and recommends upgrading to 1.12.3. It lists no workarounds. The weakness is CWE-94, improper neutralization of special elements used in code. The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: reachable over the network, a login required and a hard-to-meet condition, with high impact on everything.
The bulletin is a roll-up of several Langflow vulnerabilities and some are scored higher than this one, including a code generation flaw rated 9.8. Those are separate CVEs, but the same upgrade addresses them.
How to check if you're exposed
Check the installed version:
pip show langflow
Anything from 1.0.0 to 1.12.2 is affected. For container deployments, check the image tag.
Then look at who has accounts on your instance and whether it is reachable from outside your network. The attacker must be authenticated, so a tight account list narrows the exposure. Because IBM's description is brief, treat the Langflow host as one that could run code of an attacker's choosing, and review what it has access to.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade Langflow OSS to 1.12.3, as IBM recommends.
- Reduce the accounts that can create or edit flows and components.
- Run Langflow with least privilege, in a container, with limited network access and only the secrets it needs.
- Keep Langflow off the public internet or put it behind an authenticating proxy.
Why it matters
Langflow lets users build workflows that can include code, so a large part of the product's security depends on how it handles that code. IBM's note says special elements in input were not neutralized correctly, which is the textbook description of code injection. The bulletin as a whole shows a series of related issues across code-execution restrictions, access controls and file handling.
When the same product has repeated flaws in how it restricts code, it is a sign to treat the whole component as high-risk and isolate it. The KEV flag in the record is false and the bulletin does not report exploitation of this CVE.
Try it yourself
Langflow has shipped several IBM bulletins in a few months. This demo shows how continuous monitoring flags each new advisory for the packages you run.
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
IBM recommends Langflow OSS 1.12.3.
Is this the same as the August bulletin issues?
No. CVE-2026-9196 was in the August bulletin, fixed in 1.11.0. This one is in a later bulletin and needs 1.12.3.
Sources
Last reviewed: 18 October 2026.
