Executive brief
Langflow's CSV Agent component enables users to analyze and query CSV files using an LLM-powered agent. A hardcoded configuration exposes a Python code execution tool that allows attackers to inject arbitrary commands through prompt injection, gaining complete control of the Langflow server and any data it can access.
Technical details
The vulnerability is a code injection flaw (CWE-94) in Langflow's CSV Agent component. The agent hardcodes allow_dangerous_code=True when instantiating LangChain's create_csv_agent, which automatically enables the python_repl_ast tool. An unauthenticated attacker can craft LLM prompts that trigger Python REPL actions (via "Action: python_repl_ast" constructs), leading to arbitrary command execution on the server. No network authentication or special privileges are required—any user with access to the Langflow application can exploit this. The flaw was patched in version 1.8.0 by disabling dangerous code execution by default.
Affected products
- Langflow AI Langflow prior to 1.8.0
Timeline
- 2026-02-25: disclosed
- 2026-02-27: patched: Fixed in version 1.8.0
- 2026-02-27: advisory