{"action":"Upgrade langflow to 1.10.1.rc0 or later.","affected":[{"fixed":"1.10.1.rc0","introduced":"1.0.0"}],"component":"langflow","cve_ids":["CVE-2026-7873"],"ecosystem":"PyPI","epss":0.01071,"exploited":false,"fixed_versions":["1.10.1.rc0"],"ghsa_id":"GHSA-v798-mcc6-2m3m","id":"tcs_01M5NASX9AC7456PPCV38BS24M","modified_at":"2026-10-23T21:00:05.302716406Z","published_at":"2026-06-30T21:31:44Z","references":["https://osv.dev/vulnerability/GHSA-v798-mcc6-2m3m","https://nvd.nist.gov/vuln/detail/CVE-2026-7873","https://github.com/langflow-ai/langflow/pull/13696","https://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02","https://github.com/langflow-ai/langflow","https://github.com/langflow-ai/langflow/releases/tag/1.10.1.rc0","https://www.ibm.com/support/pages/node/7278441"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-v798-mcc6-2m3m","url":"https://osv.dev/vulnerability/GHSA-v798-mcc6-2m3m"}],"summary":"Langflow: Code Injection Vulnerability in Code Validation Endpoint"}