Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| langflow-ai | langflow | < 1.8.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Langflow RCE
exploit/multi/http/langflow_rce_cve_2026_27966
GitHub 2 repositories
-
shinthink/CVE-2026-27966 ★ 2 · Jul 5, 2026
Pre-auth RCE scanner for Langflow < 1.8.0 — Route Injection + Vertex Injection → Code Execution (CVSS 9.8)
-
Anon-Cyber-Team/CVE-2026-27966--RCE-in-Langflow ★ 2 · Mar 3, 2026
Exploit Tools For new CVE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | langflow | <= 1.8.0rc2 | — | GHSA-3645-fxcv-hqr4 |
Advisories 1
- WID-SEC-2026-0558 Langflow: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Mar 1, 2026