{"data":{"id":"87ed130e-949a-4ee3-9af1-02de8c76680f","title":"CVE-2026-12946: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the i","summary":"IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a code injection vulnerability (CWE-94, where improper handling of user input allows attackers to run arbitrary code on the system), which could let remote attackers execute malicious code. The vulnerability stems from inadequate validation and control of user-supplied input that gets processed as code.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12946","publishedAt":"2026-07-30T20:16:52.293Z","cveId":"CVE-2026-12946","cweIds":["CWE-94"],"cvssScore":"9.9","cvssSeverity":"critical","severity":"critical","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-07-30T20:16:52.293Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}