What is the CVSS score of CVE-2026-27966?

CVE-2026-27966 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-27966?

Yes, a public proof-of-concept exploit is available for CVE-2026-27966. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-27966?

Within 24 hours: Identify all systems running Langflow versions prior to 1.8.0 and assess exposure (internet-facing, internal access, data sensitivity). Within 7 days: Apply vendor patch to upgrade all affected instances to version 1.8.0 or later, or implement network-level compensating controls if patching is delayed. Within 30 days: Conduct forensic review of logs for exploitation attempts, validate patch deployment across all systems, and perform security testing to confirm remediation.

Langflow CVE-2026-27966

CRITICAL

Code Injection (CWE-94)

2026-02-26 security-advisories@github.com

GHSA-3645-fxcv-hqr4

RCE Python Command Injection AI / ML Langchain Langflow

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted prompt to CSV Agent node
Exploit

Inject malicious Python code via LangChain REPL
Execution

Execute arbitrary commands on server
Impact

Achieve full remote code execution

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Langflow versions prior to 1.8.0 with CSV Agent node active. The node hardcodes allow_dangerous_code=True, automatically enabling LangChain's python_repl_ast tool. No authentication or special configuration required — remote unauthenticated RCE against vulnerable Langflow deployments.
Impact	CVSS 9.8, EPSS 0.41%. Langflow is a popular AI workflow builder — CSV import is a common operation.
Exploit ScenarioDerived	Attacker provides crafted CSV file to a Langflow workflow, the CSV Agent processes it with dangerous code execution enabled, achieving RCE.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary code execution through crafted CSV files. EPSS 0.41% with PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Code injection via CSV Agent in Langflow AI workflow tool.

RemediationAI

Update to Langflow 1.8.0.

Affected Packages

pypi langflow no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-94 in Langflow's CSV Agent node which sets allow_dangerous_code=True, allowing pandas eval() execution on CSV data.

Know when Langflow gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 28, 2026 - 00:54 vuln.today

Public exploit code

Patch released

Feb 28, 2026 - 00:54 nvd

Patch available

CVE Published

Feb 26, 2026 - 02:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes allow_dangerous_code=True, which automatically exposes LangChain’s Python REPL tool (python_repl_ast). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.

Articles & Coverage 1

POC CVE-2026-27966 Langflow RCE Exploit Tool with Interactive Shell Mar 06, 2026

Executive ViewAI

Why It Matters

Langflow versions prior to 1.8.0 contain a critical vulnerability that allows unauthenticated attackers to execute arbitrary Python code on affected systems. Organizations using Langflow for AI workflows face immediate risk of complete system compromise, data theft, and lateral movement within their infrastructure.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is unavailable: (1) Disable or restrict access to CSV Agent nodes; (2) Implement network segmentation to limit Langflow exposure to trusted networks only; (3) Deploy WAF rules to block requests to CSV Agent endpoints; (4) Enable comprehensive logging and monitoring for Python code execution attempts; (5) Restrict Langflow service account permissions to minimize blast radius.

Threat Intelligence Overview

EPSS Score

0.4%

Top 39% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS GHSA POC (1)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available Yes

Active threat Yes

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

More in Langflow

View all

CVE-2025-3248 CRITICAL Act Now POC

9.8 Apr 07

Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling

CVE-2026-0770 CRITICAL Emergency POC

9.8 Jan 23

Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes

CVE-2025-34291 CRITICAL Act Now POC

9.4 Dec 05

Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati

CVE-2026-0768 CRITICAL Emergency POC

9.8 Jan 23

Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the

CVE-2026-0769 CRITICAL Emergency POC

9.8 Jan 23

Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted

CVE-2026-10134 CRITICAL Emergency POC

10.0 Jun 30

Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary

CVE-2024-37014 CRITICAL Act Now POC

9.8 Jun 10

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo

CVE-2026-105697 CRITICAL Act Now POC

9.9 Oct 05

OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end

CVE-2024-48061 CRITICAL Act Now POC

9.8 Nov 04

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the

CVE-2024-42835 CRITICAL Act Now POC

9.8 Oct 31

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

CVE-2026-21445 CRITICAL Act Now POC

9.1 Jan 02

Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us

CVE-2026-33475 CRITICAL Act Now POC

9.1 Mar 24

An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

PATCH https://github.com/langflow-ai/langflow/commit/d8c6480daa17b2f2af0b5470cdf5c3d28dc9e508

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back