Quick answers
- Is CVE-2026-33873 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33873 being exploited in the wild.
- How severe is CVE-2026-33873?
- Critical severity, with a CVSS score of 4, published 26 March 2026.
- Which products and versions are affected?
- Langflow <= 1.8.1; langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.0.
- Is there a fix for CVE-2026-33873?
- Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33873 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-33873?
- Check whether you run Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- langflow (PyPI): upgrade to 1.9.0 or later
pip install "langflow>=1.9.0"
Technical details
A remote code execution vulnerability exists in Langflow's Agentic Assistant feature due to the unsafe handling of LLM-generated code. When a user interacts with the `/assist` endpoint, the application extracts component code from the model's response and passes it to a validation routine. This routine invokes `create_class()` within `lfx.custom.validate`, which uses the Python `exec()` function to dynamically instantiate the generated class. Because the validation phase is not sandboxed and treats model output as trusted executable code, an authenticated attacker can influence the LLM to produce malicious Python payloads that execute in the context of the Langflow server process. This vulnerability is patched in version 1.9.0.
Affected products
- langflow-ai langflow <= 1.8.1
Identifiers
- CVE-2026-33873
- GHSA-v8hw-mh8c-jxfc
- PYSEC-2026-82
Timeline
- 2026-03-24: advisory: Original GitHub Advisory published
- 2026-03-26: disclosed
- 1.9.0: patched