CVE-2026-8481info

Summary

by MITRE • 07/17/2026

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Disclosure

07/17/2026

Moderation

in review

EPSS

0.00000

KEV

no

Activities

very low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-8481
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-8481
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-8481/

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!