{"data":{"id":"e3dddfc4-6bf2-43c8-a825-dcbb90a25fa7","title":"CVE-2026-6543: IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges…","summary":"CVE-2026-6543 affects IBM Langflow Desktop 1.0.0 through 1.8.4. An attacker can execute arbitrary commands with the privileges of the process running Langflow, which allows reading sensitive environment variables such as API keys and DB credentials, modifying files, or launching further attacks on the internal network. The weakness is classified as CWE-94, Improper Control of Generation of Code ('Code Injection').","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6543","publishedAt":"2026-04-30T22:16:26.467Z","cveId":"CVE-2026-6543","cweIds":["CWE-94"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow Desktop"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow Desktop arbitrary command execution","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0047,"epssCheckedAt":"2026-11-09T06:13:52.357Z","kevDateAdded":null,"advisoryAliases":["GHSA-3qgh-3gr3-38fg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:15.500Z","patchAvailable":null,"disclosureDate":"2026-04-30T22:16:26.467Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}