CVE-2026-93449: High Code Injection in IBM Langflow OSS

CVE-2026-93449 is a high severity (CVSS 8.5) code injection flaw in IBM Langflow OSS 1.0.0 through 1.12.2. It is a sibling of CVE-2026-93445: a remote authenticated attacker can run arbitrary code through improper control of code generation. IBM's remediation is Langflow OSS 1.12.3.

What's affected

Langflow OSS 1.0.0 through 1.12.2 is affected per the record and IBM's bulletin. IBM recommends upgrading to 1.12.3 and lists no workarounds. The weakness class is CWE-94.

This entry scores slightly higher than its sibling because the CVSS vector marks the scope as changed and impact on availability as high. The attack complexity is rated high, which means conditions beyond the attacker's control have to line up. Do not read the higher complexity as a reason to wait. The bulletin treats the whole set of Langflow issues as one upgrade.

IBM publishes one bulletin for many Langflow identifiers, so you may see the same fix version cited next to several CVE numbers in your scanner.

How to check if you're exposed

Confirm the installed version everywhere Langflow runs.

pip show langflow

In containers, run the command inside the image or read the tag you deploy. Treat anything from 1.0.0 to 1.12.2 as affected.

Then list the accounts that can sign in to the instance. The record requires an authenticated attacker, so the size of that group tells you how exposed you are.

What to do now

1. Upgrade to Langflow OSS 1.12.3 or later. One upgrade covers every identifier in IBM's bulletin.
2. Pin the version in your requirements file or image build so a later rebuild does not drift back.
3. Reduce the number of accounts with flow authoring rights to the people who need them.
4. Keep secrets out of the Langflow process environment where you can, and scope any tokens it needs.
5. Note the fix in your vulnerability tracker once for the product rather than once per CVE, and link both identifiers to it.
6. Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.

Why it matters

Code injection in a tool whose job is to compose and run behavior is the kind of weakness that appears again and again, because every new component type is another place where input can reach a code generator. CWE-94 entries often arrive in groups for that reason.

A changed scope in the vector means the impact can reach beyond the vulnerable component itself, for example to the host or to systems the service can reach. The record does not flag KEV status, and IBM does not report exploitation. Patch on the normal fast track for high severity issues.

Quick check

Sources

• IBM Security Bulletin 7290694

Last reviewed: 18 October 2026.