{"data":{"id":"87a8bc32-79f8-4960-a332-4109dd4769fb","title":"CVE-2026-8481: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API…","summary":"CVE-2026-8481 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and runs it directly with exec(), without sandboxing, input validation, or privilege restrictions. Any authenticated user can therefore execute arbitrary system commands with the full privileges of the Langflow server process.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8481","publishedAt":"2026-07-17T20:17:30.747Z","cveId":"CVE-2026-8481","cweIds":["CWE-94"],"cvssScore":"9.9","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS remote code execution in code validation API","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00875,"epssCheckedAt":"2026-11-14T00:05:45.937Z","kevDateAdded":null,"advisoryAliases":["GHSA-6jrp-2cpp-fpm4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:10:00.107Z","patchAvailable":null,"disclosureDate":"2026-07-17T20:17:30.747Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}