Description

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-28T22:16:47.613Z",
  "pubdate": "2026-08-28T22:16:47.613Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.1 are susceptible to a critical OS command injection vulnerability. This flaw enables an authenticated user to bypass restrictive security policies, specifically the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false control, to execute arbitrary operating system commands within the server process context.\nThe vulnerability originates from improper validation of the type field during flow saving and building operations. By crafting a malicious type field value and wrapping it in a secondary flow reference, an attacker can achieve remote code execution (RCE) on the underlying server host.\nThis impact allows for full system compromise, as the attacker effectively operates with the privileges of the Langflow server process. The vulnerability presents a severe risk to confidentiality, integrity, and availability. Successful exploitation requires authenticated access to the platform; however, it effectively elevates a standard user account to full administrative control over the server environment. Organizations utilizing affected versions are strongly advised to restrict access and apply available updates immediately.",
  "technicalDetails": "The vulnerability resides in the flow processing architecture of IBM Langflow OSS, specifically within the input handling logic responsible for parsing flow component types. The system fails to implement sufficient input sanitization or whitelist validation when processing the 'type' field during the flow save sequence.\nThe exploitation process begins with an authenticated attacker submitting a crafted flow configuration. By supplying a malicious payload within the 'type' field, the attacker bypasses the internal security check governed by the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false configuration. This boolean control is intended to restrict users from executing custom or arbitrary components, but the logic fails to account for the instantiation of these components through the wrapper flow mechanism.\nThe attack flow follows these steps: 1) The attacker defines a flow object containing the malicious 'type' value. 2) This flow is saved to the backend storage. 3) The attacker then creates or modifies a 'wrapper' flow that references the previously saved malicious component. 4) Upon triggering a 'build' operation on the wrapper flow, the Langflow engine invokes the component loader. 5) The loader, failing to validate the source of the reference, processes the malicious 'type' parameter, which directs the server process to execute OS-level commands specified by the attacker.\nBecause the server process executes these instructions, the injected commands inherit the full system permissions of the Langflow service account. This bypasses the intended compartmentalization of the application, allowing an attacker to read/write arbitrary files, exfiltrate environment variables, pivot into the internal network, or deploy persistent backdoors on the host operating system.\nThe vulnerable component is the internal component resolution logic, which fails to verify that the 'type' definition aligns with sanctioned, secure classes. Even with the custom component policy explicitly disabled, the system's reliance on client-provided metadata for server-side object instantiation remains the primary vector for exploitation. The lack of secondary verification or secure sandboxing for component execution ensures that once the build process is initiated, the server executes the injected command sequence without further oversight."
}