IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.

CVE-2026-7803 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability allows arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields. An attacker could exploit this flaw by crafting malicious flow nodes that bypass input validation checks. The issue resides in how the application handles component type fields, failing to enforce proper validation when these fields are absent or empty. This could lead to full system compromise if exploited in a production environment. IBM has published an advisory with remediation guidance. The vulnerability is rated high severity given the potential for arbitrary code execution.