CVE-2026-33475: Langflow shell injection in GitHub Actions workflows via branch name

Summary

Multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0 interpolate GitHub context variables such as `${{ github.head_ref }}` directly into `run:` steps without sanitization. A malicious branch name or pull request title lets an unauthenticated attacker inject and execute arbitrary shell commands during CI/CD runs, potentially exposing secrets such as `GITHUB_TOKEN`, manipulating infrastructure, or compromising the supply chain. The proof of concept sends the CI token to an external URL.

Mitigation

Fixed in 1.9.0. The advisory's suggested fix is to refactor affected workflows to pass user-controlled values through environment variables and wrap them in double quotes, and to avoid direct `${{ ... }}` interpolation inside `run:` for user-controlled values.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News