Langflow: Code Injection Vulnerability in Code Validation Endpoint

GHSA-v798-mcc6-2m3m · CVE-2026-7873 · 갱신 2026. 10. 24.

해야 할 일

langflow: 1.10.1.rc0 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	langflow	1.10.1.rc0

원문

Langflow: Code Injection Vulnerability in Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-7873
WEBhttps://github.com/langflow-ai/langflow/pull/13696
WEBhttps://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02
PACKAGEhttps://github.com/langflow-ai/langflow
WEBhttps://github.com/langflow-ai/langflow/releases/tag/1.10.1.rc0
WEBhttps://www.ibm.com/support/pages/node/7278441

오늘 목록으로

Langflow: Code Injection Vulnerability in Code Validation Endpoint (GHSA-v798-mcc6-2m3m) · Sieve