CVE-2026-27966: Langflow Remote Code Execution Vulnerability in CSV Agent
Summary
CVE-2026-27966: Langflow has Remote Code Execution in CSV Agent. Affects langflow versions < 1.8.0rc2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed to facilitate the construction of applications that utilize large language models (LLMs). It allows users to create flows that integrate various components, such as agents and outputs, to manipulate and query data efficiently. However, a critical vulnerability exists within the CSV Agent component, which can lead to severe security risks.
Vulnerability Detail
The CSV Agent in Langflow has a hardcoded parameter 'allow_dangerous_code=True', which inadvertently exposes the Python REPL tool. This configuration allows attackers to execute arbitrary Python code and OS commands on the server through prompt injection. The vulnerability arises from the lack of a toggle or configuration option to disable this dangerous behavior, resulting in a potential full Remote Code Execution (RCE) scenario.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually modify the source code in 'src/lfx/src/lfx/components/langchain_utilities/csv_agent.py' to set 'allow_dangerous_code=False'. However, this is not a recommended long-term solution.
Conclusion
The Langflow CSV Agent vulnerability (CVE-2026-27966) poses a significant risk due to its ability to allow remote code execution through prompt injection. Users are strongly encouraged to update to the latest version or implement the recommended workarounds to mitigate the risk.
See every vulnerability recorded for langflow →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability allows remote attackers to execute arbitrary Python code and system commands, potentially leading to a full takeover of the server environment.
Currently, there is no UI toggle or environment variable to disable this feature in the affected versions of Langflow.
If you cannot update immediately, consider implementing the temporary workaround by modifying the source code to disable the dangerous code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
