Langflow: Langflow’s AI CSV Agent Vulnerability Allows Remote Code Execution Attacks

Critical Zero-Day Vulnerability in Langflow AI Platform Exposes Systems to Remote Code Execution

A severe security flaw in Langflow, a widely used AI application platform, has been disclosed, allowing attackers to execute arbitrary code remotely via its CSV data-processing agent. The vulnerability, tracked as CVE-2026-27966, carries a critical severity score of 10.0, indicating an immediate and high-risk threat to affected systems.

Root Cause & Exploitation Mechanism

The vulnerability stems from a hardcoded setting in Langflow’s CSV Agent node, which enables users to query or analyze CSV files using a language model (LLM). The issue lies in the allow_dangerous_code=True configuration, which is permanently enabled and activates LangChain’s python_repl_ast tool a feature designed to execute Python code.

Due to the lack of user-controlled toggles for this setting, attackers can exploit it through prompt injection. By crafting malicious prompts in the chat interface, they can trick the AI into running system commands, such as:

import("os").system("echo pwned > /tmp/pwned")

Since the system executes these commands without validation, attackers can gain full control of the server, enabling data theft, file deletion, or malware installation without requiring authentication or user interaction.

Impact & Affected Systems

The flaw poses a severe risk to any organization using Langflow, as it allows unauthenticated remote code execution (RCE). Exploitation could lead to:

• Complete system compromise
• Unauthorized data access or exfiltration
• Deployment of ransomware or backdoors

Patch & Mitigation

Langflow’s development team released version 1.8.0 to address the issue, likely by disabling the dangerous code execution setting by default. Users are strongly advised to upgrade immediately to prevent exploitation. The official security advisory was published on GitHub, detailing the fix and urging prompt action.

The discovery underscores the growing risks of AI-driven automation tools with insecure default configurations, particularly in frameworks handling untrusted input.

Source: https://cybersecuritynews.com/langflows-ai-csv-agent-vulnerability/

Langflow cybersecurity rating report: https://www.rankiteo.com/company/langflow

"id": "LAN1772548356",
"linkid": "langflow",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/AI',
                        'name': 'Langflow',
                        'type': 'AI Application Platform'}],
 'attack_vector': 'Remote Code Execution (RCE) via prompt injection',
 'data_breach': {'data_exfiltration': 'Possible'},
 'description': 'A severe security flaw in Langflow, a widely used AI '
                'application platform, has been disclosed, allowing attackers '
                'to execute arbitrary code remotely via its CSV '
                'data-processing agent. The vulnerability, tracked as '
                'CVE-2026-27966, carries a critical severity score of 10.0, '
                'indicating an immediate and high-risk threat to affected '
                'systems.',
 'impact': {'data_compromised': 'Unauthorized data access or exfiltration',
            'operational_impact': 'Deployment of ransomware or backdoors',
            'systems_affected': 'Complete system compromise'},
 'lessons_learned': 'The discovery underscores the growing risks of AI-driven '
                    'automation tools with insecure default configurations, '
                    'particularly in frameworks handling untrusted input.',
 'post_incident_analysis': {'corrective_actions': 'Disable dangerous code '
                                                  'execution setting by '
                                                  'default in version 1.8.0',
                            'root_causes': 'Hardcoded setting '
                                           '(`allow_dangerous_code=True`) in '
                                           'Langflow’s CSV Agent node enabling '
                                           'Python code execution without '
                                           'validation'},
 'recommendations': 'Users are strongly advised to upgrade immediately to '
                    'version 1.8.0 to prevent exploitation.',
 'references': [{'source': 'GitHub Security Advisory'}],
 'response': {'containment_measures': 'Upgrade to version 1.8.0',
              'remediation_measures': 'Disable dangerous code execution '
                                      'setting by default'},
 'title': 'Critical Zero-Day Vulnerability in Langflow AI Platform Exposes '
          'Systems to Remote Code Execution',
 'type': 'Zero-Day Vulnerability',
 'vulnerability_exploited': 'CVE-2026-27966'}