CVE-2026-27966: langflow-ai langflow Code Injection
Vulnerability summary
CVE-2026-27966 is a critical (CVSS 9.8) Code Injection vulnerability in langflow-ai langflow. EPSS estimates a 2.55% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-02-2026PublishedVulnerability first disclosed.
- 28-02-2026Last modifiedVulnerability information updated.
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.55%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
-31.15 pp
From 33.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundLangflow
Maturity: poc
Langflow RCE
exploit/multi/http/langflow_rce_cve_2026_27966
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products
References
6 links- github.com/langflow-ai/langflow/security/advisories/GHSA-3645-fxcv-hqr4X Refsource CONFIRMWEBExploitVendor Advisory
- github.com/langflow-ai/langflow/commit/d8c6480daa17b2f2af0b5470cdf5c3d28dc9e508X Refsource MISCWEBPatch
- pypi.org/project/langflowPACKAGE