{
 "id": "AIR-2026-1243",
 "slug": "ibm-langflow-oss-executes-unintended-code-during-agentic-ass",
 "title": "IBM Langflow OSS executes unintended code during Agentic Assistant validation",
 "summary": "IBM Langflow OSS improperly handles LLM-generated components by executing model-generated Python code in the backend prior to user approval. An attacker can exploit this to trigger side effects such as outbound network access, file system interaction, or data exfiltration.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "agent_hijack"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow OSS"
 ],
 "incident_date": "2026-08-05",
 "incident_date_precision": "day",
 "first_reported": "2026-08-05",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9196",
   "publisher": "NVD",
   "title": "CVE-2026-9196: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant…",
   "published_at": "2026-08-05"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-9196",
  "code-execution",
  "infra_vuln"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}