Langflow hat Remote Code Execution in CSV Agent

The impact of CVE-2026-27966 is severe. An attacker can leverage prompt injection within the CSV Agent node to execute arbitrary Python code. Because allowdangerouscode is hardcoded to True, no additional configuration is required for exploitation. This allows for direct execution of OS commands, granting the attacker full control over the affected server. The blast radius extends to any data processed by the CSV Agent, as an attacker could exfiltrate sensitive information or modify data. This vulnerability shares similarities with other prompt injection attacks targeting LLM-powered applications, highlighting the importance of secure coding practices and input validation.

Organizations utilizing Langflow for data processing and analysis, particularly those relying on the CSV Agent node for interacting with CSV files, are at significant risk. Shared hosting environments where multiple users share the same Langflow instance are especially vulnerable, as a compromised flow could impact other users.

• python / server:

import os
import subprocess

def check_langflow_version():
    try:
        process = subprocess.run(['pip', 'show', 'langflow'], capture_output=True, text=True)
        output = process.stdout
        if 'Version:' in output:
            version = output.split('Version:')[1].strip().split('\n')[0]
            if version <= '1.8.0rc2':
                print(f'Langflow version is vulnerable: {version}')
            else:
                print(f'Langflow version is patched: {version}')
        else:
            print('Langflow not found.')
    except FileNotFoundError:
        print('pip not found.')

check_langflow_version()

• linux / server:

ps aux | grep -i langflow

• generic web: Inspect Langflow flow configurations for the use of the CSV Agent node and review associated prompts for suspicious code.

1. 2026-02-27Disclosure

   disclosure

2. 2026-02-27Patch

   patch

1. Reserviert2026-02-25
2. Veröffentlicht2026-02-27
3. Geändert2026-02-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27966 is to upgrade Langflow to version 1.8.0 or later, which resolves the hardcoded allowdangerouscode=True setting. If upgrading is not immediately feasible, consider implementing strict input validation on any data passed to the CSV Agent node to prevent malicious prompt injection. While a direct workaround is not available, limiting the permissions of the user account running the Langflow application can reduce the potential impact of a successful exploit. After upgrading, confirm the fix by attempting a prompt injection attack and verifying that the Python REPL tool is no longer accessible.