{"document":{"category":"csaf_vex","csaf_version":"2.0","title":"CVE-2026-10561: Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection","publisher":{"category":"vendor","name":"HarborGuard Database","namespace":"https://database.harborguard.co"},"tracking":{"id":"CVE-2026-10561","status":"final","version":"1","initial_release_date":"2026-06-22T13:22:07.628Z","current_release_date":"2026-06-22T13:22:07.628Z","revision_history":[{"date":"2026-06-22T13:22:07.628Z","number":"1","summary":"Initial machine-readable export from HarborGuard."}]},"distribution":{"tlp":{"label":"WHITE"},"text":"Public CVE data; freely redistributable."},"notes":[{"category":"description","text":"IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise","title":"CVE description"}],"references":[{"category":"self","summary":"CVE-2026-10561 on HarborGuard Database","url":"https://database.harborguard.co/cve/CVE-2026-10561"},{"category":"external","summary":"CVE Record","url":"https://www.cve.org/CVERecord?id=CVE-2026-10561"},{"category":"external","summary":"ibm.com","url":"https://www.ibm.com/support/pages/node/7277242"}]},"product_tree":{"branches":[{"category":"vendor","name":"IBM","branches":[{"category":"product_name","name":"Langflow OSS","branches":[{"category":"product_version_range","name":">=1.0.0 <=1.9.3","product":{"name":"IBM Langflow OSS >=1.0.0 <=1.9.3","product_id":"CSAFPID-1","product_identification_helper":{"cpe":"cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*"}}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-10561","title":"Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection","notes":[{"category":"description","text":"IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise","title":"CVE description"}],"product_status":{"known_affected":["CSAFPID-1"]},"scores":[{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL"},"products":["CSAFPID-1"]}],"remediations":[{"category":"none_available","details":"No fixed version is published yet. Monitor the upstream advisory.","product_ids":["CSAFPID-1"]}]}]}