CVE Intelligence
Analysis AI-assisted

CVE-2026-27966: Langflow CSV Agent: code injection leading to RCE

CVE-2026-27966 affects Langflow before 1.8.0. The CSV Agent node automatically exposes a Python execution tool, so prompt injection can lead to arbitrary code execution on the server. The record fixes it in 1.8.0 and gives a CVSS 3.1 score of 9.8 (critical).

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Langflow is a tool for building and deploying AI-powered agents and workflows. According to the record, the CSV Agent node in versions before 1.8.0 hardcodes a setting that automatically enables LangChain's Python REPL tool. Prompt injection can then lead to arbitrary Python and operating system command execution on the server.

Impact

  • The record classifies the weakness as CWE-94 (Code Injection), which can result in remote code execution on the host running Langflow.
  • The CVSS 3.1 base score is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network attack, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.

Affected products and versions

  • Langflow before 1.8.0, listed under the product names Langflow Langflow and Langflow-ai Langflow.
  • The record identifies 1.8.0 as the version that fixes the issue, and links a patch commit.

Exploitation status

  • The CISA KEV flag in the record is false, so no active exploitation is confirmed by that catalog. No confirmed exploitation in the wild appears in the sources consulted.
  • The record lists an SSVC exploitation value of poc and includes a reference tagged as Exploit. This suggests that proof-of-concept material may exist, but it does not confirm exploitation in the wild.
  • The EPSS probability is 0.02547 with percentile 0.84906, as recorded.

Remediation and mitigation

  • Upgrade Langflow to version 1.8.0 or a later release that includes the fix.
  • Until upgrading, review which flows use CSV Agent nodes and limit who can create, edit or run them.
  • Restrict network exposure of Langflow instances and run the service with least privilege.

Detection guidance

  • Review logs and host telemetry for unexpected child processes or outbound connections originating from the Langflow service.
  • Audit flows that contain CSV Agent nodes and review recent changes to them.

Limitations of the available information

  • The record does not describe the exact conditions under which prompt injection succeeds in every deployment.
  • No KEV due date or required action is provided, since the CVE is not listed.
  • Later fixed releases beyond 1.8.0 are not documented in the record, so only the 1.8.0 endpoint is stated.

Frequently asked questions

What is the root cause of CVE-2026-27966?

According to the record, the CSV Agent node in Langflow before 1.8.0 hardcodes a setting that automatically exposes LangChain's Python REPL tool, which can be abused through prompt injection.

Is this vulnerability known to be actively exploited?

No. The CISA KEV flag in the record is false, and no confirmed exploitation in the wild appears in the sources consulted, although the record includes an exploit-tagged reference and an SSVC value of poc.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.