Dependency Confusion in the Langflow Batch: When the Supply Chain Is the Bug
IBM has published a security bulletin covering 25 vulnerabilities in Langflow OSS versions 1.0.0 through 1.12.2. One entry among them does not follow the pattern of the rest.
Vulnerability Overview
CVE-2026-93675, which carries a CVSS score of 8.8, abuses dependency confusion. It needs no login, although a user must take an action for it to be triggered. Dependency confusion is a package resolution problem: it exploits the way a resolver decides which source wins when the same package name exists in more than one place.
Mechanism and Exploitation Conditions
Why It Is Not an Injection Bug
The critical entries in this batch are injection style. CVE-2026-104334 stems from improper control of code generation, and CVE-2026-93674 involves improper neutralization of special elements used in an OS command. Both need no login and no user interaction.
Dependency confusion reaches the same destination through the build and install path instead. It requires a human action, which is why it is not rated critical, but the outcome is still untrusted code inside the platform.
The Rest of the Batch
Most of the other Langflow vulnerabilities target authenticated users. CVE-2026-97655 slips past an incomplete blocklist in the code security scanner, CVE-2026-97676 enables a sandbox escape, and CVE-2026-93447 abuses deserialization of cached Redis values but requires the server secret and Redis write access.
Impact
A workflow platform that resolves packages at build time inherits every risk of the package ecosystem behind it. For Langflow operators, the practical consequence is that patching the application does not remove the need to pin and verify dependencies.
Affected Products and Scope
All 25 flaws affect Langflow OSS 1.0.0 through 1.12.2. Of the 25 flaws, 2 are critical, 19 are high and 4 are medium, and 15 of these flaws can lead to code execution. IBM's advisory does not report exploitation in the wild, and no public proof-of-concept has been confirmed.
Remediation and Mitigations
Upgrade to Langflow 1.12.3. IBM strongly recommends addressing the vulnerability now. Until the upgrade is done, keep Langflow off the public internet, limit who can create or edit flows, and after patching rotate any API keys and credentials that are stored in the platform.
Top comments (0)