CVE-2026-33873PYSEC-2026-82GHSA-V8HW-MH8C-JXFC
Langflow has Authenticated Code Execution in Agentic Assistant Validation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.9.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- langflow-ai langflow
fixed in 1.9.0
- langflowPyPI
fixed in 1.9.0
References 16
GitHub · langflow-ai/langflow
- Advisory GHSA-v8hw-mh8c-jxfc
- src/backend/base/langflow/agentic/api/router.py · L252-L297
- src/backend/base/langflow/agentic/api/schemas.py · L20-L31
- src/backend/base/langflow/agentic/helpers/code_extraction.py · L11-L53
- src/backend/base/langflow/agentic/helpers/validation.py · L27-L47
- src/backend/base/langflow/agentic/services/assistant_service.py · L142-L156
- src/backend/base/langflow/agentic/services/assistant_service.py · L259-L300
- src/backend/base/langflow/agentic/services/assistant_service.py · L58-L79
- src/backend/base/langflow/api/utils/core.py · L38
- src/backend/base/langflow/api/v1/login.py · L96-L135
- src/backend/base/langflow/services/auth/utils.py · L156-L163
- src/backend/base/langflow/services/auth/utils.py · L39-L53
- src/lfx/src/lfx/custom/validate.py · L241-L272
- src/lfx/src/lfx/custom/validate.py · L394-L399
- src/lfx/src/lfx/custom/validate.py · L441-L443
- src/lfx/src/lfx/services/settings/auth.py · L71-L87