CVE-2026-33873: Langflow has Authenticated Code Execution in Agentic Assistant Validation

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 1.8%, percentile 78: FIRST’s model estimates a 1.8% chance of exploitation activity in the next 30 days, higher than 78% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes langflow (PyPI) <= 1.8.1, fixed in 1.9.0. Check your lockfile, including transitive dependencies.

What it is

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.

From the GitHub advisory

Description

1. Summary

The Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side.

In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution.

2. Description

Weakness type: CWE-94.

Product: langflow (PyPI) · Assigned by: GitHub_M · Published: 2026-03-27

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: low (any account)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 1.82% probability of exploitation activity in the next 30 days; percentile 78.

Timeline

• 2026-03-26 — GitHub-reviewed advisory GHSA-v8hw-mh8c-jxfc published (critical)
• 2026-03-27 — CVE record published by GitHub_M
• 2026-04-02 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-v8hw-mh8c-jxfc github.com
2. CVE.org record CVE-2026-33873 cve.org
3. NVD entry CVE-2026-33873 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. github.com github.com
7. github.com github.com
8. github.com github.com
9. github.com github.com
10. github.com github.com
11. github.com github.com
12. github.com github.com
13. github.com github.com
14. github.com github.com
15. github.com github.com
16. github.com github.com
17. github.com github.com

Critical PyPI advisories · Today’s Security Digest