CVE-2026-76059: IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.11.5 has a vulnerability where an attacker can upload malicious custom component code that tricks the static security scanner (a tool that checks code before it runs) by using alias tracking (following variable names to their actual values). Because of a logic error, the dangerous code is never checked against a blocklist of forbidden operations, allowing the attacker to execute arbitrary operating system commands on the server with the privileges of the running service.