{"data":{"id":"cd318589-0307-4d0a-82c2-8035259c787e","title":"CVE-2026-27966: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent…","summary":"CVE-2026-27966 affects Langflow versions prior to 1.8.0. The CSV Agent node hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain's `python_repl_ast` Python REPL tool. An attacker can use prompt injection to execute arbitrary Python and OS commands on the server, resulting in full Remote Code Execution (RCE). The weakness is classified as CWE-94.","solution":"Version 1.8.0 fixes the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27966","publishedAt":"2026-02-26T02:16:23.833Z","cveId":"CVE-2026-27966","cweIds":["CWE-94"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.8.0rc2"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow","LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow CSV Agent code execution through prompt injection","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.35246,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-3645-fxcv-hqr4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:41.535Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}