IBM separately reports CVE-2026-110193 in Langflow’s Agentic Assistant. Its generated component code could use a path that was missing from the restricted operation patterns, permitting operating-system command execution for an authenticated low-privilege actor in affected versions. The structural risk is familiar but the route is distinct: checking a…
Inspect the ClaimsCase · DiggingBeagle record
Langflow Agentic Assistant generated component code bypassed a Python restriction list
An authenticated user could cause unsafe generated Python component execution through code not covered by a syntactic restriction list.
Scope
Authenticated low-privilege use of the affected Langflow Agentic Assistant in versions before 1.13.0; not unauthenticated host compromise.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
IBM publishes a vulnerability and repair, but the publicly available material does not provide a complete independent execution transcript. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-LANGFLOW-AGENTIC-PYTHON-1 · IBM Langflow OSS multi-vulnerability bulletin for 1.13.0
At a glance
The advisory labels the route separately from MCP enumeration; an unverified call stack cannot be merged with another Langflow RCE.
Read the implicationsThe precise previously allowed Python expression path was not independently reproduced. Current runtime sandbox protection beyond the vendor statement is unknown.
Limits and uncertaintyFull account
IBM separately reports CVE-2026-110193 in Langflow’s Agentic Assistant. Its generated component code could use a path that was missing from the restricted operation patterns, permitting operating-system command execution for an authenticated low-privilege actor in affected versions. The structural risk is familiar but the route is distinct: checking a language model’s generated Python source against an incomplete list does not necessarily constrain what the Python interpreter can do when the code runs.
The vendor lists 1.13.0 as the fix. Available public information does not identify every omitted pattern or show that code generated in an unrelated workflow can reach the same sink. A defense should be evaluated at runtime permission boundaries, with source filtering treated as an additional control rather than a substitute for isolating execution.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-LANGFLOW-AGENTIC-PYTHON-1IBM identifies CVE-2026-110193 as a low-privilege-generated-component command-execution path fixed in Langflow 1.13.0.supported
Basis: reported finding
- supportsIBM Langflow OSS multi-vulnerability bulletin for 1.13.0vendor statement
IBM bulletin, CVE-2026-110193 Agentic Assistant generated-component restrictions
Implications
The advisory labels the route separately from MCP enumeration; an unverified call stack cannot be merged with another Langflow RCE.
Controls and mitigations
- Upgrade to 1.13.0 or later and enforce process-level restrictions independent of Python syntax or model-generated code.
Unknowns and contradictions
- The precise previously allowed Python expression path was not independently reproduced.
- Current runtime sandbox protection beyond the vendor statement is unknown.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208