IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

CVE-2026-19295 affects IBM Langflow OSS versions 1.0.0 through 1.11.1, allowing an authenticated attacker to execute arbitrary operating system commands on the server. The attack vector involves saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This vulnerability enables privilege escalation from an authenticated flow user to arbitrary OS-level command execution under the server process identity. Critically, it bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control, rendering that security configuration ineffective. The vulnerability is classified as high severity given the potential for full server compromise by any authenticated user. Organizations running affected versions of IBM Langflow OSS should apply patches or mitigations immediately as described in IBM's security advisory.