CVE-2026-27966: Langflow CSV Agent Node RCE Vulnerability

CVE-2026-27966 Overview

CVE-2026-27966 is a critical Remote Code Execution (RCE) vulnerability in Langflow, a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes allow_dangerous_code=True, which automatically exposes LangChain's Python REPL tool (python_repl_ast). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution.

Critical Impact

This vulnerability allows unauthenticated attackers to execute arbitrary code on the server through prompt injection, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• Langflow versions prior to 1.8.0
• Langflow CSV Agent component
• Systems utilizing LangChain's python_repl_ast tool through Langflow

Discovery Timeline

• 2026-02-26 - CVE-2026-27966 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27966

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in the CSV Agent component of Langflow, where the allow_dangerous_code parameter is hardcoded to True. This configuration decision exposes LangChain's python_repl_ast tool, which provides a Python Read-Eval-Print Loop (REPL) capability directly within the agent workflow.

The architectural flaw allows user-controlled input to be processed by the agent, which can then execute arbitrary Python code through the exposed REPL tool. Since the CSV Agent is designed to process user prompts for data analysis, an attacker can craft malicious prompts that inject Python code instead of legitimate data queries.

Root Cause

The root cause of this vulnerability is the hardcoded insecure configuration in the CSV Agent component. By setting allow_dangerous_code=True by default, the component inherently trusts all input and permits code execution without any sanitization or user consent. This violates the principle of secure-by-default design and fails to implement proper input validation boundaries between user prompts and code execution capabilities.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending a crafted prompt to a Langflow instance running the CSV Agent
2. Embedding Python code within the prompt that gets interpreted by the python_repl_ast tool
3. Executing arbitrary commands including OS-level operations through Python's subprocess or os modules
4. Achieving full RCE with the privileges of the Langflow process

The security patch addresses this by adding a BoolInput control to allow administrators to explicitly configure whether dangerous code execution should be permitted:

    HandleInput,
    MessageTextInput,
)
+from lfx.io import BoolInput
from lfx.schema.message import Message
from lfx.services.deps import get_settings_service
from lfx.template.field.base import Output

Source: GitHub Commit Update

The component hash was also updated to track the security fix:

   },
   "CSVAgent": {
     "versions": {
-      "0.3.0": "97947e212da9"
+      "0.3.0": "4978be110e63"
     }
   },
   "LangChainFakeEmbeddings": {

Source: GitHub Commit Update

Detection Methods for CVE-2026-27966

Indicators of Compromise

• Unusual Python subprocess or os module calls originating from Langflow processes
• Unexpected network connections initiated by the Langflow server to external hosts
• Anomalous file system operations in directories accessible to the Langflow service account
• Evidence of prompt injection patterns in application logs containing Python code syntax

Detection Strategies

• Monitor Langflow application logs for prompts containing Python keywords such as import, exec, eval, subprocess, or os.system
• Deploy network monitoring to detect outbound connections from Langflow instances to unexpected destinations
• Implement runtime application self-protection (RASP) to detect code execution attempts within the agent workflow
• Use SentinelOne's behavioral AI to identify anomalous process spawning from Langflow parent processes

Monitoring Recommendations

• Enable verbose logging for the CSV Agent component to capture all input prompts
• Configure alerting for any shell command execution originating from Python processes associated with Langflow
• Monitor for file creation or modification in sensitive system directories by Langflow processes
• Implement egress filtering and alert on any data exfiltration attempts from Langflow hosts

How to Mitigate CVE-2026-27966

Immediate Actions Required

• Upgrade Langflow to version 1.8.0 or later immediately
• If upgrade is not immediately possible, disable or remove the CSV Agent component from all workflows
• Review Langflow logs for any signs of exploitation prior to patching
• Isolate Langflow instances from critical network segments until patched

Patch Information

The vulnerability is fixed in Langflow version 1.8.0. The patch introduces a BoolInput configuration option that allows administrators to explicitly control whether dangerous code execution is permitted in the CSV Agent. By default, this is now set to False, implementing a secure-by-default configuration.

For technical details on the fix, refer to:

• GitHub Commit Update
• GitHub Security Advisory GHSA-3645

Workarounds

• Disable the CSV Agent component entirely in Langflow deployments until an upgrade can be performed
• Implement network segmentation to restrict Langflow server access to trusted sources only
• Deploy a web application firewall (WAF) with rules to detect and block common prompt injection patterns
• Run Langflow in a sandboxed environment with minimal privileges and no outbound network access

# Configuration example: Restricting Langflow network access with iptables
# Drop all outbound connections from Langflow except to required services
iptables -A OUTPUT -m owner --uid-owner langflow -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner langflow -p tcp --dport 443 -d api.allowed-service.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner langflow -j DROP