CVE-2026-27966

Langflow versions prior to 1.8.0 hardcode allow_dangerous_code=True in the CSV Agent node, which silently exposes LangChain's Python REPL tool (python_repl_ast) to the agent. An attacker who can influence prompts or data processed by a flow using this node, for example via chat input or uploaded CSV content, can inject instructions that make the REPL execute arbitrary Python and, from there, OS commands. This yields full remote code execution on the server with the privileges of the Langflow process, enabling data theft, tampering, and further compromise. Any deployment of Langflow below 1.8.0 whose flows use the CSV Agent node is affected, with internet-facing or multi-user instances at highest risk. No confirmed in-the-wild exploitation is reported yet (not in CISA KEV), but a public security advisory exists and EPSS assigns a 33.7% probability of exploitation within 30 days, so patching should be treated as urgent.

What to do: Upgrade Langflow to version 1.8.0 or later. Until patched, avoid the CSV Agent node in any flow that processes untrusted prompts or files, and restrict network exposure of Langflow instances rather than leaving them reachable without authentication. Check server logs for unexpected Python or shell command execution originating from agent flows.