Quick answers
- Is CVE-2026-27966 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-27966 being exploited in the wild.
- How severe is CVE-2026-27966?
- Critical severity, with a CVSS score of 9.8, published 27 February 2026.
- Which products and versions are affected?
- langflow (PyPI) <= 1.8.0rc2, ECOSYSTEM:introduced=0,last_affected=1.8.0rc2.
- Is there a fix for CVE-2026-27966?
- A patch was published on 2026-02-27: Fixed in version 1.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-27966 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-27966?
- Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection flaw (CWE-94) in Langflow's CSV Agent component. The agent hardcodes allow_dangerous_code=True when instantiating LangChain's create_csv_agent, which automatically enables the python_repl_ast tool. An unauthenticated attacker can craft LLM prompts that trigger Python REPL actions (via "Action: python_repl_ast" constructs), leading to arbitrary command execution on the server. No network authentication or special privileges are required—any user with access to the Langflow application can exploit this. The flaw was patched in version 1.8.0 by disabling dangerous code execution by default.
Affected products
- Langflow AI Langflow prior to 1.8.0
Identifiers
- CVE-2026-27966
- GHSA-3645-fxcv-hqr4
- PYSEC-2026-376
Timeline
- 2026-02-25: disclosed
- 2026-02-27: patched: Fixed in version 1.8.0
- 2026-02-27: advisory