CVE-2026-33873 CRITICAL

CVE-2026-33873: Langflow has Authenticated Code Execution in Agentic Assistant Validation

Vendor Langflow-Ai
Product langflow
Weakness CWE-94 · Code injection
Published March 27, 2026
Last update April 2, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.

Key dates

02Disclosure timeline

March 27, 2026 CVE published
April 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-9519 Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode CVE-2023-1482 HkCms External Plugin code injection CVE-2024-10959 Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth CVE-2025-62348 Salt junos module uses an unsafe YAML loader which may allow unintended code execution CVE-2025-2303 Block Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution