External risk intelligence

IBM Langflow PythonREPL Sandbox Input Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-13435

IBM Langflow is a web-based tool for building AI workflows that is frequently deployed as a web application or API service. Given its functional role as a web application development environment and interface, it is commonly exposed as an internet-facing service or internal portal, making it likely to be reachable from the network.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM Langflow OSS, a tool for building AI workflows, has a critical vulnerability in its PythonREPL sandbox that could allow unauthorized access and manipulation if exploited. This issue affects versions 1.0.0 through 1.10.1 and is considered external, meaning it can be reached over a network. The primary concern is to confirm if this technology is in use and assess potential exposure.

A flaw allows unauthorized control of AI workflow tools.
It impacts internet-facing AI workflow development tools.
Confirm usage; assess potential impact and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to a vulnerable component. This could lead to unauthorized access and manipulation of sensitive data or system functions.

Requires authenticated access.
Triggered by improper input validation.
Risk of code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

The PythonREPL sandbox implementation in IBM Langflow OSS could be vulnerable to improper input validation, potentially allowing for the execution of arbitrary code when supported by the advisory's conditions.

Python code execution in the sandbox.
Unsanitized user input to the sandbox.
Potential for unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM Langflow OSS, used for building AI workflows, is likely managed by platform or application teams responsible for its deployment and security. Initial actions should focus on identifying all instances of this technology, assessing their reachability and criticality to business operations, locating the accountable owners, and then prioritizing remediation efforts based on identified risks.

Platform and application teams own remediation.
Verify internet-facing instances and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is an open-source development tool designed for building and managing AI-driven workflows. It provides a visual interface for developers to create complex automation pipelines, often involving data processing and Python-based logic, which are typically deployed as web applications or API services.

What does CWE-94 mean for CVE-2026-13435?

CWE-94 refers to Improper Control of Generation of Code. In the context of this CVE, it means the application fails to properly validate input before passing it to the PythonREPL sandbox. Because the sandbox does not sufficiently restrict the commands it accepts, a user could supply malicious input that the system executes as if it were legitimate code.

How is this vulnerability triggered?

The vulnerability is triggered when a user with authenticated access sends specially crafted input to the PythonREPL component. It is important to note that this is not a blind attack; it requires the attacker to interact with the system's input fields in a way that bypasses validation. Without authenticated access or input that targets this specific sandbox function, the exploit path is not activated.

Is my IBM Langflow instance at risk?

According to Halo Surface Signal, this software is frequently deployed as a web application or internal portal, making it likely to be reachable over a network. If your instance is internet-facing or hosted on a shared network, it is accessible to others, which elevates the potential for unauthorized access compared to a strictly isolated environment.

What are the first steps to address this issue?

Start by identifying every instance of IBM Langflow OSS within your environment and verifying its version against the affected range of 1.0.0 through 1.10.1. Once identified, map these instances to their owners and determine if they are accessible from the network. Prioritize securing or restricting access to any internet-facing instances while awaiting further remediation guidance from the vendor.

References

www.ibm.com/support/pages/node/7279987

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.