CVE-2026-93445 is a high severity (CVSS 8.1) code injection flaw in IBM Langflow OSS 1.0.0 through 1.12.2. A remote authenticated attacker can make the application generate and run code of their choosing. IBM's bulletin says to upgrade to Langflow OSS 1.12.3 and lists no workarounds.
What's affected
The record and IBM's bulletin agree: Langflow OSS 1.0.0 through 1.12.2 is affected, and IBM's remediation is version 1.12.3. The weakness is CWE-94, improper control of generation of code. The attacker must be authenticated, which the CVSS vector reflects as low privileges required.
IBM's bulletin is a shared one. It lists a number of Langflow OSS issues covering code execution restrictions, access control, file access and archive handling, so the same upgrade covers more than this one identifier. The CVSS vector for this entry is network reachable, low complexity, with high confidentiality and integrity impact and no availability impact. IBM's bulletin gives no mitigation other than the upgrade.
How to check if you're exposed
Find the Langflow version in every environment where it runs: laptops, notebooks, containers and shared servers.
pip show langflow
pip list 2>/dev/null | grep -i langflow
For containers, check the image tag and run the same command inside the container. Any version from 1.0.0 to 1.12.2 is in scope.
Also ask who can log in. Langflow lets users build flows that include custom components, so every account that can author flows should be treated as able to reach this class of bug until you upgrade.
What to do now
- Upgrade Langflow OSS to 1.12.3 or later, following IBM's bulletin.
- Rebuild and redeploy container images so the old version does not linger in a cached layer.
- Review who holds accounts on your Langflow instance and remove any that are no longer needed.
- Run Langflow with the least privilege you can: a dedicated service account, no cloud credentials in its environment unless a flow needs them, and network egress limits.
- After the upgrade, check logs from the exposure window for unexpected flow edits or new components.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
CWE-94 describes software that builds code from input without fully controlling what is built. Langflow exists to let people assemble and run flows, which makes the line between data and executable behavior thin. When that line is not enforced, an ordinary authenticated account becomes a way to run code as the service.
This CVE is not in CISA's Known Exploited Vulnerabilities catalog, and neither the record nor IBM's bulletin reports exploitation. The practical risk is still real for any shared instance, because a code execution flaw in a workflow tool often sits next to API keys and model credentials.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to be attacked?
Yes. The record describes a remote authenticated attacker and the CVSS vector lists low privileges required. Shared instances with many accounts carry the most risk.
Is there a workaround?
IBM's bulletin lists no workarounds or mitigations. The fix is Langflow OSS 1.12.3.
Sources
Last reviewed: 18 October 2026.
