High severity8.8NVD Advisory· Published Sep 10, 2026· Updated Sep 16, 2026
CVE-2026-81940
CVE-2026-81940
Description
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3>=1.0.0,<1.11.5+ 1 more
- (no CPE)range: >=1.0.0,<1.11.5
- cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*range: >=1.0.0,<1.11.6
- Range: 1.0.0 - 1.11.5
Patches
Vulnerability mechanics
References
1- www.ibm.com/support/pages/node/7286666nvdVendor Advisory
News mentions
3- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and MoreThe Hacker News · Oct 19, 2026
- IBM: 25 Vulnerabilities Across Db2, Langflow OSS, and DataStage Disclosed TogetherVypr Intelligence · Sep 10, 2026
- IBM Langflow OSS: Batch of 18 Vulnerabilities Disclosed, Including Critical Code Execution FlawsVypr Intelligence · Sep 10, 2026