CVE-2026-33873: RCE in Langflow Agentic Assistant

The impact of CVE-2026-33873 is severe. An attacker who can influence the model output within the Agentic Assistant feature can inject malicious Python code. This code will be executed on the server during the validation phase, granting the attacker arbitrary code execution capabilities. This can lead to complete system compromise, including data exfiltration, malware installation, and lateral movement within the network. The ability to execute arbitrary code bypasses standard security controls and allows for a wide range of malicious activities. The vulnerability's reliance on model output manipulation makes it particularly concerning in environments where AI models are exposed to untrusted input.

1. Reserved2026-03-24
2. Published2026-03-27
3. Modified2026-04-02
4. EPSS updated2026-04-04

The primary mitigation for CVE-2026-33873 is to immediately upgrade Langflow to version 1.9.0 or later. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on the model's input to prevent malicious code injection. Additionally, restrict access to the Agentic Assistant feature to trusted users only. Monitor server logs for suspicious Python code execution patterns. While a WAF might offer some protection, it is unlikely to be effective against this type of vulnerability due to the dynamic nature of the code execution. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual Python process activity is recommended.