Exploit for CVE-2026-27966
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.
Published: 2026-02-26
CVSS: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Download Exploit for CVE-2026-27966 here:
Tip: Download official Tor Browser at https://www.torproject.org/download/ to access .onion links.
Check our portfolio:
https://veletacapital.com/exploit-793-cve-2026-24111/
https://veletacapital.com/exploit-273-cve-2020-37176/
