PT-2026-28544 · Langflow · Langflow

Kexinoh · Published 2026-03-26 · Updated 2026-03-28 · CVE-2026-33873

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0

Description Langflow's Agentic Assistant feature, prior to version 1.9.0, executes LLM-generated Python code during validation. This implementation allows for arbitrary server-side Python execution if an attacker can access the Agentic Assistant feature and influence the model output. The vulnerable code path involves processing model output through a chain that ultimately invokes create class(), which dynamically executes Python code using exec(). The affected endpoints include /api/v1/login and the assistant feature relies on user authentication via bearer token, cookie, or API key. Default deployment settings, such as AUTO LOGIN=true and the /api/v1/auto login endpoint, may widen exposure. The issue is an authenticated code execution vulnerability, with severity depending on the deployment model.

Recommendations Versions prior to 1.9.0 should be updated to version 1.9.0 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-33873

ECHO-E568-958C-EC51

GHSA-V8HW-MH8C-JXFC

PYSEC-2026-82

Affected Products

Langflow

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33873.json · Exploit
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-v8hw-mh8c-jxfc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8hw-mh8c-jxfc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33873 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33873 · Security Note
• https://github.com/langflow-ai/langflow · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/schemas.py#L20-L31 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/helpers/validation.py#L27-L47 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/services/assistant_service.py#L259-L300 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/services/auth/utils.py#L156-L163 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/lfx/src/lfx/custom/validate.py#L241-L272 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/helpers/code_extraction.py#L11-L53 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/services/assistant_service.py#L142-L156 · Note
• https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297 · Note