Threat Library

IBM Langflow, an open-source visual builder for AI agent/LLM workflows, contains a critical remote code execution flaw in its code validation API. Any authenticated user can submit Python code that is run directly via exec() with no sandboxing, granting them full control over the server process. Given a 9.9 CVSS score, this is a near-maximum severity issue requiring immediate patching or mitigation.

IBM Langflow's disk caching component deserializes cached objects using Python's unsafe pickle.loads() without any validation or authentication. An attacker who can influence cache contents—via crafted workflow inputs, custom components, or API calls—can trigger arbitrary code execution with the privileges of the Langflow server, leading to full system compromise.

AWS HealthOmics MCP Server's linting tools failed to properly restrict pathnames, allowing an actor who can influence the MCP agent's workflow_files input to write attacker-controlled content outside the intended workflow bundle directory via directory traversal sequences. This is a classic path traversal vulnerability exposed through an MCP tool interface rather than a novel agent-specific attack, and is fixed in version 0.0.36.

ForgeCode, an AI pair-programming CLI, automatically parses and executes MCP server configurations from a repository's .mcp.json file without any user confirmation. A malicious or compromised repository can embed arbitrary OS commands in this file, achieving code execution with the developer's privileges the moment they run forge inside the cloned repo. This turns routine repository evaluation into a reliable initial-access vector for supply-chain attacks against developers.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing an authenticated attacker to read arbitrary files on the host, including the JWT signing key used to issue authentication tokens. With this key, an attacker can forge valid tokens and impersonate any user, effectively bypassing authentication controls within the Langflow agent-building platform.

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

Langflow, an open-source framework used to build AI agent workflows, contains a server-side request forgery vulnerability caused by weak default configuration and incomplete SSRF protections. An attacker could exploit this to make the Langflow server issue unauthorized requests to internal or cloud-metadata endpoints, potentially exposing sensitive infrastructure or credentials. This is a genuine, credibly documented vulnerability (CVSS 7.7) rather than a speculative or low-quality report.

IBM Langflow, an open-source visual builder for AI agent workflows, contains a path traversal flaw where a malicious flow can fetch attacker-controlled content and write it to arbitrary paths on the server via a crafted Content-Disposition header. An authenticated attacker can abuse this to overwrite configuration, code, or scheduled/startup files, likely leading to full compromise of the Langflow instance. This is a serious framework-level vulnerability requiring only low-privilege authenticated access.

A vulnerability in IBM Langflow's Python Interpreter component allows an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation. This affects Langflow OSS versions 1.0.0 through 1.10.1, and could allow an attacker with low-level access to escalate privileges and take control of the underlying system. Given the CVSS score of 8.8, this is a serious flaw that requires prompt patching.

IBM Langflow OSS versions 1.0.0 through 1.10.1 expose a public flow build endpoint that allows unauthenticated remote code execution due to an incomplete security denylist. Attackers can construct flows using code-execution-capable agent components (OpenDsStarAgent, CodeActAgentSmolagents, CSVAgent) that are not blocked by the validation function, achieving arbitrary code execution without any authentication.

IBM Langflow contains a vulnerability where its ToolGuard security policy fails to validate dynamically generated Python code fields, allowing attackers with flow creation privileges to inject and execute arbitrary code on the backend despite custom component restrictions being disabled. The flaw is worsened by an MCP tool that accepts attacker-controlled user IDs, enabling cross-tenant injection into other users' flows, and can require little to no authentication under common misconfigurations.

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

IBM Langflow OSS versions 1.0.0-1.10.0 allow unauthenticated attackers to register new user accounts that, under the common NEW_USER_IS_ACTIVE=true configuration, are immediately active without admin approval. This lets attackers authenticate and reach code-execution endpoints, effectively bypassing intended access controls even when AUTO_LOGIN is disabled. Given the critical CVSS score of 9.8, this is a genuine and severe vulnerability requiring urgent patching.

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability chain allowing any unauthenticated network attacker to obtain superuser credentials and execute arbitrary code on the server. This affects default deployments of a widely used AI agent-building platform, giving attackers full control of the host and any connected agent workflows, data, or credentials.

Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.

LiteLLM 1.18.10 allows any user who can submit MCP server configuration JSON to specify arbitrary OS commands and arguments that are executed unvalidated on the host. This gives an attacker remote code execution with the privileges of the LiteLLM process, a critical risk given the 9.8 CVSS score and the ease of exploitation.

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

Agentic-Flow's MCP server tools passed user- and agent-supplied parameters (agent, task, name, language, agentdb) directly into shell commands via execSync() without sanitization, enabling arbitrary OS command execution. Any client, upstream agent, or automated caller able to invoke these MCP tools could achieve full remote code execution at the privilege level of the MCP server process. This is a critical, unauthenticated-adjacent injection flaw affecting core orchestration and swarm tooling.

This is a follow-up disclosure from Embrace The Red detailing how an LLM agent that outputs untrusted content into a macOS Terminal could be leveraged to trigger DNS requests via crafted ANSI escape sequences, effectively exfiltrating data through DNS lookups. Apple has since fixed the underlying macOS Terminal behavior, so this report documents a resolved vulnerability rather than an active ongoing threat. Severity is moderate given the fix is already deployed, but the technique remains relevant for agents/tools still rendering raw terminal output without sanitization.

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.