Vulnerability Details CVE-2026-3357
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.7%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-3357
-
cpe:2.3:a:langflow:langflow:1.6.0
-
cpe:2.3:a:langflow:langflow:1.6.1
-
cpe:2.3:a:langflow:langflow:1.6.10
-
cpe:2.3:a:langflow:langflow:1.6.2
-
cpe:2.3:a:langflow:langflow:1.6.3
-
cpe:2.3:a:langflow:langflow:1.6.4
-
cpe:2.3:a:langflow:langflow:1.6.5
-
cpe:2.3:a:langflow:langflow:1.6.6
-
cpe:2.3:a:langflow:langflow:1.6.7
-
cpe:2.3:a:langflow:langflow:1.6.8
-
cpe:2.3:a:langflow:langflow:1.6.9
-
cpe:2.3:a:langflow:langflow:1.7.0
-
cpe:2.3:a:langflow:langflow:1.7.1
-
cpe:2.3:a:langflow:langflow:1.7.2
-
cpe:2.3:a:langflow:langflow:1.7.3
-
cpe:2.3:a:langflow:langflow:1.8.0
-
cpe:2.3:a:langflow:langflow:1.8.1
-
cpe:2.3:a:langflow:langflow:1.8.2