CVE-2026-97679

{
  "etk_id": "ETK-2026-845",
  "cve_id": "CVE-2026-97679",
  "display_id": "CVE-2026-97679",
  "ghsa_id": "GHSA-f4v9-vgq2-xwmv",
  "euvd_id": "EUVD-2026-94124",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated OS command injection in Langflow OSS",
  "summary": "IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by improper input validation in OS command handling. An authenticated remote attacker may be able to execute arbitrary code. Exploitation requires access to an authenticated account.",
  "mitigation": "Restrict access to Langflow accounts and limit network exposure to trusted users and networks. Monitor for a vendor-corrected release and deploy it when available.",
  "vendor": "IBM",
  "product": "Langflow OSS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, <= 1.12.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Langflow OSS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0045,
  "epss_percentile": 0.3768,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 46.132880633333336,
  "t0_at": "2026-10-06T23:59:33.248000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-07T05:27:11.241374+00:00",
      "days": 0.22752307145833334,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T23:59:33.248000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T23:59:33.248000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T23:59:33.248000+00:00",
      "url": "https://github.com/advisories/GHSA-f4v9-vgq2-xwmv"
    }
  }
}