Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-3357

IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Langflow Desktop

  • 1.6.0 to ≤ 1.8.2affected

References