{
 "id": "AIR-2026-1022",
 "slug": "ibm-langflow-desktop-insecure-deserialization-vulnerability",
 "title": "IBM Langflow Desktop Insecure Deserialization Vulnerability",
 "summary": "An insecure default setting in IBM Langflow Desktop permits the deserialization of untrusted data in the FAISS component. This flaw could allow an authenticated user to execute arbitrary code on the system.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "supply_chain"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "IBM Langflow Desktop"
 ],
 "incident_date": "2026-04-08",
 "incident_date_precision": "day",
 "first_reported": "2026-04-08",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3357",
   "publisher": "NVD",
   "title": "CVE-2026-3357: IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system,…",
   "published_at": "2026-04-08"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-3357",
  "deserialization",
  "langflow"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}