CVE-2026-3357

IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file

CVSS 8.8 HIGHEPSS 0.5%CWE-502

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

08 abr 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

IBM · Langflow Desktop

Referencias

https://www.ibm.com/support/pages/node/7268428