# CVE-2026-33873: Langflow authenticated code execution in Agentic Assistant validation

Source: https://junglewise.ai/threats/cve-2026-33873-langflow-authenticated-code-execution-in-agentic-assistant  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-33873 · Severity: critical · CVSS 4 · Published 2026-03-26

Langflow, a tool for building AI-powered applications, contains a vulnerability in its Agentic Assistant feature. This feature is intended to help users generate and validate code for AI components; however, it incorrectly executes the generated code on the server during the validation step. An attacker with access to this feature can provide inputs that cause the server to run malicious Python code, potentially leading to a full takeover of the server, data theft, or service disruption.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow), [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33873 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33873 being exploited in the wild.

**How severe is CVE-2026-33873?** Critical severity, with a CVSS score of 4, published 26 March 2026.

**Which products and versions are affected?** Langflow <= 1.8.1; langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.0.

**Is there a fix for CVE-2026-33873?** Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33873 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33873?** Check whether you run Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "langflow>=1.9.0"
  ```


## Technical details

A remote code execution vulnerability exists in Langflow's Agentic Assistant feature due to the unsafe handling of LLM-generated code. When a user interacts with the `/assist` endpoint, the application extracts component code from the model's response and passes it to a validation routine. This routine invokes `create_class()` within `lfx.custom.validate`, which uses the Python `exec()` function to dynamically instantiate the generated class. Because the validation phase is not sandboxed and treats model output as trusted executable code, an authenticated attacker can influence the LLM to produce malicious Python payloads that execute in the context of the Langflow server process. This vulnerability is patched in version 1.9.0.

## Affected products

- langflow-ai langflow <= 1.8.1

## Identifiers

- CVE-2026-33873
- GHSA-v8hw-mh8c-jxfc
- PYSEC-2026-82

## Timeline

- 2026-03-24: advisory: Original GitHub Advisory published
- 2026-03-26: disclosed
- 1.9.0: patched

## References

- [https://api.github.com/users/kexinoh](https://api.github.com/users/kexinoh)
- [https://github.com/kexinoh](https://github.com/kexinoh)
- [https://api.github.com/users/kexinoh/gists%7B/gist_id%7D](https://api.github.com/users/kexinoh/gists%7B/gist_id%7D)
- [https://api.github.com/users/kexinoh/repos](https://api.github.com/users/kexinoh/repos)
- [https://avatars.githubusercontent.com/u/91727108?v=4](https://avatars.githubusercontent.com/u/91727108?v=4)
- [https://api.github.com/users/kexinoh/events%7B/privacy%7D](https://api.github.com/users/kexinoh/events%7B/privacy%7D)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)