CVE-2026-27966
Critical · 9.8CVSS
9.8
EPSS
2.5%
Published
Feb 26, 2026
CISA due date
—
The record
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | langflow | 0 | No fix |
Related vulnerabilities
- GHSA-3645-fxcv-hqr4 Langflow has Remote Code Execution in CSV Agent Same vulnerability
- GHSA-g22f-v6f7-2hrh Langflow affected by Remote Code Execution via validate_code() exec() Also affects langflow
- CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… Also affects langflow
- GHSA-c5cp-vx83-jhqx Langflow Missing Authentication on Critical API Endpoints Also affects langflow
- CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints Also affects langflow
- GHSA-f43r-cc68-gpx4 External Control of File Name or Path in Langflow Also affects langflow
- GHSA-5993-7p27-66g5 Langflow vulnerable to Server-Side Request Forgery Also affects langflow
- CVE-2025-68477 Langflow vulnerable to Server-Side Request Forgery Also affects langflow