What is GHSA-gx45-8jc3-gqqr?

GHSA-gx45-8jc3-gqqr is a security advisory published by GitHub Security Advisories with Critical severity. IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution...

Which CVE IDs does GHSA-gx45-8jc3-gqqr cover?

GHSA-gx45-8jc3-gqqr covers the following CVE IDs: CVE-2026-12940. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gx45-8jc3-gqqr?

GHSA-gx45-8jc3-gqqr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-gx45-8jc3-gqqrCriticalCVSS 9.8

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-12940 →

📋 Description

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12940
https://www.ibm.com/support/pages/node/7279995
https://github.com/advisories/GHSA-gx45-8jc3-gqqr