Skip to content

An editorial team and a community building with AI

vibecoding.incJoin Discord ↗
← All articles

News · IBM (Langflow OSS) / GitHub Security Advisories · 2 min read

Event date: · Published:

High severity path traversal flaw disclosed in IBM Langflow OSS

GitHub disclosed a High-severity path traversal vulnerability, CVE-2026-97677, affecting IBM Langflow OSS versions 1.0.0 through 1.12.2, the open-source builder for LLM and agent workflows.

GitHub published a High-severity security advisory for IBM Langflow OSS, the open-source visual builder for large language model and agent workflows, on November 8, 2026. The advisory, GHSA-54m9-hhxp-c88f, discloses a path traversal vulnerability tracked as CVE-2026-97677 that lets an authenticated flow author write or read files outside the intended sandbox.

What the advisory discloses

  • CVE-2026-97677 (GHSA-54m9-hhxp-c88f) was published to the GitHub Advisory Database on November 8, 2026
  • The flaw is rated High severity with a CVSS 3.1 score of 8.1 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
  • It affects IBM Langflow OSS versions 1.0.0 through 1.12.2
  • The issue is classified as CWE-22, improper limitation of a pathname to a restricted directory
  • An authenticated flow author can write attacker-controlled file content into any directory accessible to the service account, bypassing Langflow's local file-access isolation safeguard
  • A crafted on-disk index can also be used to read arbitrary files the service process can access, including configuration files, secrets, or database files under the application's data directory

What it means for AI builders

Langflow is widely used to prototype LLM and agent pipelines, so a path traversal flaw that lets an authenticated collaborator read secrets or write files outside the sandbox is a direct risk for teams self-hosting Langflow OSS for AI agent development. Because the CVSS vector shows the attack requires only low privileges and no user interaction, any teammate with flow-author access, not just an administrator, can trigger the write or read.

Patch availability

No patched version was listed in the advisory at the time of publication, so teams running IBM Langflow OSS 1.0.0 through 1.12.2 do not yet have an official fix to apply and should keep an eye on the advisory for updates while limiting who holds flow-author access in self-hosted instances.

Sources

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.

High severity path traversal flaw disclosed in IBM Langflow OSS | vibecoding.inc