High severity8.8NVD Advisory· Published Sep 10, 2026· Updated Sep 16, 2026
CVE-2026-78571
CVE-2026-78571
Description
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: 1.0.0 - 1.11.5
>=1.0.0,<1.11.6+ 1 more
- (no CPE)range: >=1.0.0,<1.11.6
- cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*range: >=1.0.0,<1.11.6
Patches
Vulnerability mechanics
References
1- www.ibm.com/support/pages/node/7286666nvdVendor Advisory
News mentions
2- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and MoreThe Hacker News · Oct 19, 2026
- IBM Langflow OSS: Batch of 18 Vulnerabilities Disclosed, Including Critical Code Execution FlawsVypr Intelligence · Sep 10, 2026