Code Injection Vulnerability in IBM Langflow OSS Product

CVE-2026-9135

What is CVE-2026-9135?

IBM Langflow OSS contains a code injection vulnerability in the Policies component's ToolGuard integration. This flaw allows authenticated users with flow creation privileges to execute arbitrary Python code on the backend, bypassing security controls. The vulnerability arises as the validation mechanism fails to thoroughly check dynamic CodeInput fields, enabling attackers to inject malicious code into flows. When certain misconfigurations are present, the attack can be conducted even with reduced authentication requirements, posing significant risks to system integrity and data security.

References