Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.

According to its banner, the version of Langflow running on the remote host is prior to 1.9.0. It is, therefore, affected by a multiples vulnerabilities :

- An Authenticated Code Execution in agentic assistant validation

- An Unauthenticated Remote Code Execution via public flow build endpoint

- A Path Traversal in knowledge bases API via bulk delete endpoint

- An Arbitrary File Write (RCE) through the V2 API

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the
    Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase.
    Although this phase appears intended to validate generated component code, the implementation reaches
    dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker
    can access the Agentic Assistant feature and influence the model output, this can result in arbitrary
    server-side Python execution. Version 1.9.0 fixes the issue. (CVE-2026-33873)

ID	Name	Product	Family	Type	Severity
115277	Langflow < 1.9.0 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
439338	SCA: security update for langflow (GHSA-v8hw-mh8c-jxfc)	Tenable Cloud Security	SCA Checks	Local	critical
439338	SCA: security update for langflow (GHSA-v8hw-mh8c-jxfc)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-33873

critical

Tenable Plugins

critical

critical

critical