CVE-2026-93675 is a remote code execution flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2, rated 8.8 (high). IBM attributes it to an expected dependency confusion. IBM recommends upgrading to Langflow OSS 1.12.3 and lists no workarounds, so plan the upgrade now.
What's affected
- Product: Langflow OSS, the open source tool for building AI workflows.
- Affected: versions 1.0.0 through 1.12.2.
- Fixed: 1.12.3, per IBM's security bulletin.
- Workarounds and mitigations: IBM lists none.
- The same bulletin covers other Langflow issues, including path traversal, access control and code injection entries, so the upgrade closes a group of CVEs at once.
How to check if you're exposed
Check the installed Langflow version everywhere it runs, including notebooks, containers and developer machines:
pip show langflow
pip list 2>/dev/null | grep -i langflow
docker ps --format '{{.Image}}' | grep -i langflow
Anything from 1.0.0 through 1.12.2 is in scope. If Langflow runs in a container image, check the image tag and any lock file used when it was built.
What to do now
- Upgrade Langflow OSS to 1.12.3 or later, and rebuild container images from the new version rather than patching in place.
- Pin your Python dependencies with hashes in your lock file so a package from the wrong index cannot be installed by name alone.
- Configure pip or your package manager to use your intended index for internal packages, and review any extra index settings.
- Limit who can reach Langflow, and avoid running it with broad credentials, since code execution runs with the service's rights.
- Read IBM's bulletin for the other CVEs it lists and confirm your upgraded version covers them.
Why it matters
The record lists CWE-440, expected behavior violation. IBM's description is short: a remote attacker could execute arbitrary code because of an expected dependency confusion. Dependency confusion is the general class of problem in which a build or runtime picks up a package from the wrong source, such as a public package that shares a name with a private or expected one. The advisory does not give more detail than that, so this post does not either.
The vector is network based with low complexity, needs no privileges and needs a user action, which explains 8.8. It is not marked as exploited in the wild in the record.
Dependency confusion is also a reminder of why a full dependency inventory matters. You can see what a project pulls in, and from where, with the free in-browser dependency scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is dependency confusion in one sentence?
It is when a package manager installs a package from an unintended source because a name matches, so the code that runs is not the code you meant to use.
Is there a workaround if I cannot upgrade this week?
IBM lists none. Reduce exposure by limiting network access and by controlling which package indexes your environment can reach until you upgrade.
Sources
Last reviewed: 19 October 2026.
