HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-97679 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...

·Source: NIST NVD

Updated:

Executive Summary

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.

Analysis

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation. CVSS Score: 8.8. Published: 2026-10-07T01:16:36.643.

Indicators of Compromise (1)

CVE (1)
CVE-2026-97679
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU...

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVE-2026-77936
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77933 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau...

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

CVE-2026-77933
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77932 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi...

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserve

CVE-2026-77932
NIST NVD