# CVE-2026-27966: Langflow has Remote Code Execution in CSV Agent

Source: https://junglewise.ai/threats/cve-2026-27966-langflow-csv-agent-remote-code-execution-via-hardcoded-python  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-27966 · Severity: critical · CVSS 9.8 · Published 2026-02-27

Langflow's CSV Agent component enables users to analyze and query CSV files using an LLM-powered agent. A hardcoded configuration exposes a Python code execution tool that allows attackers to inject arbitrary commands through prompt injection, gaining complete control of the Langflow server and any data it can access.

Technologies: [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-27966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27966 being exploited in the wild.

**How severe is CVE-2026-27966?** Critical severity, with a CVSS score of 9.8, published 27 February 2026.

**Which products and versions are affected?** langflow (PyPI) <= 1.8.0rc2, ECOSYSTEM:introduced=0,last_affected=1.8.0rc2.

**Is there a fix for CVE-2026-27966?** A patch was published on 2026-02-27: Fixed in version 1.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27966 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-27966?** Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in Langflow's CSV Agent component. The agent hardcodes allow_dangerous_code=True when instantiating LangChain's create_csv_agent, which automatically enables the python_repl_ast tool. An unauthenticated attacker can craft LLM prompts that trigger Python REPL actions (via "Action: python_repl_ast" constructs), leading to arbitrary command execution on the server. No network authentication or special privileges are required—any user with access to the Langflow application can exploit this. The flaw was patched in version 1.8.0 by disabling dangerous code execution by default.

## Affected products

- Langflow AI Langflow prior to 1.8.0

## Identifiers

- CVE-2026-27966
- GHSA-3645-fxcv-hqr4
- PYSEC-2026-376

## Timeline

- 2026-02-25: disclosed
- 2026-02-27: patched: Fixed in version 1.8.0
- 2026-02-27: advisory

## References

- [https://github.com/langflow-ai/langflow/security/advisories/GHSA-3645-fxcv-hqr4](https://github.com/langflow-ai/langflow/security/advisories/GHSA-3645-fxcv-hqr4)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)