CVE-2026-12946 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability allows a remote attacker to inject arbitrary code on the system due to improper control of user input code. This is classified as a code injection vulnerability, which typically carries high severity due to the potential for full system compromise. The flaw is remotely exploitable without physical access to the target system. IBM has published a support advisory addressing this issue. The NVD entry is currently awaiting full analysis and scoring. Organizations using affected versions of IBM Langflow OSS should review the IBM advisory and apply any available patches or mitigations promptly.