IBM reports 25 Langflow flaws, including dependency confusion bug

IBM published a security bulletin covering 25 vulnerabilities in Langflow OSS 1.0.0 through 1.12.2: 2 critical, 19 high and 4 medium, with 15 allowing code execution. CVE-2026-93675, rated 8.8, abuses dependency confusion and requires user action. The fix is upgrading to Langflow 1.12.3.

• CVE-2026-93675 (CVSS 8.8) exploits package resolution at build time
• 15 of the 25 flaws can lead to code execution
• No exploitation in the wild or public PoC confirmed
• IBM advises keeping Langflow off the public internet until patched