What happened
CVE-2026-110193 (CVSS 8.8, CWE-94): IBM Langflow OSS 1.0.0 through 1.12.8 allows a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using unblocked patterns, resulting in arbitrary operating system command execution on the server.
Why it matters
Langflow is a widely-deployed AI orchestration platform whose agentic Assistant generates/runs component code; an unblocked code-generation pattern turns into server-side command execution. Given Langflow's history of KEV/critical findings, this is a meaningful blast radius for agent-served AI applications.
Attack vector
An authenticated low-privilege user drives the Agentic Assistant to generate/submit component code that uses unblocked patterns, which are then executed as OS commands on the server.
Affected systems
IBM Langflow OSS 1.0.0 through 1.12.8.
Mitigation
Upgrade Langflow OSS past 1.12.8 per the IBM advisory; restrict who can drive code-generating agent components.