{"items":[{"id":"NVI-00008882","kind":"vulnerability","title":"Langflow has Remote Code Execution in CSV Agent","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3645-fxcv-hqr4","CVE-2026-27966"],"plain_summary":"GitHub lists this reviewed advisory for langflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2a33da49264ffaae694bdfe6632357aa"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T17:28:26.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-17683677363ed78c9c9d4a7b10a0fde8"},{"kind":"CVSS","as_of":"2026-06-17T10:27:59.160Z","value":"9.8 CRITICAL (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-000dc5aa7e9efa0f91652d73ace50fdc"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"35.246%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.98445. Missing scores are unknown.","source_id":"sr-2a33da49264ffaae694bdfe6632357aa"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-17683677363ed78c9c9d4a7b10a0fde8","url":"https://github.com/advisories/GHSA-3645-fxcv-hqr4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3645-fxcv-hqr4","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-000dc5aa7e9efa0f91652d73ace50fdc","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27966","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-27966","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T17:44:02.655Z"},{"id":"sr-2a33da49264ffaae694bdfe6632357aa","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-27966","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.781Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-17683677363ed78c9c9d4a7b10a0fde8"],"technology":"langflow","known_exclusions":[],"conditions_summary":"# 1. Summary\n\n\nThe CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE).\n\n# 2. Description\n\n## 2.1 Intended Functionality\n\nWhen building a flow such as *ChatInput → CSVAgent → ChatOutput*, users can attach an LLM and specify a CSV file path. The CSV Agent then provides capabilities to query, summarize, or manipulate the CSV content using an LLM-driven agent.\n\n## 2.2 Root Cause\n\nIn `src/lfx/src/lfx/components/langchain_utilities/csv_agent.py`, the CSV Agent is instantiated as follows:\n\n```python\nagent_kwargs = {\n    \"verbose\": self.verbose,\n    \"allow_dangerous_code\": True,  # hardcoded\n}\nagent_csv = create_csv_agent(..., **agent_kwargs)\n```\n\nBecause `allow_dangerous_code` is hardcoded to `True`, LangChain automatically enables the `python_repl_ast` tool. Any LLM output that issues an action such as:\n\n```\nAction: python_repl_ast\nAction Input: **import**(\"os\").system(\"echo pwned > /tmp/pwned\")\n```\n\nis executed directly on the server.\n\nThere is no ","public_affected_ranges":["<= 1.8.0rc2"]}],"null_published_at":"2026-11-08T19:53:33.627Z","source_updated_at":"2026-10-27T17:28:26.000Z","source_disclosed_at":"2026-02-27T15:47:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00008882","kind":"vulnerability","title":"Langflow has Remote Code Execution in CSV Agent","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3645-fxcv-hqr4","CVE-2026-27966"],"plain_summary":"GitHub lists this reviewed advisory for langflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eaa0cfa816c061b9032e1e79b4a4a11"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T17:28:26.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-17683677363ed78c9c9d4a7b10a0fde8"},{"kind":"CVSS","as_of":"2026-06-17T10:27:59.160Z","value":"9.8 CRITICAL (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-000dc5aa7e9efa0f91652d73ace50fdc"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"35.246%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.98442. Missing scores are unknown.","source_id":"sr-0eaa0cfa816c061b9032e1e79b4a4a11"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-17683677363ed78c9c9d4a7b10a0fde8","url":"https://github.com/advisories/GHSA-3645-fxcv-hqr4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3645-fxcv-hqr4","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-000dc5aa7e9efa0f91652d73ace50fdc","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27966","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-27966","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T17:44:02.655Z"},{"id":"sr-0eaa0cfa816c061b9032e1e79b4a4a11","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-27966","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.376Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-17683677363ed78c9c9d4a7b10a0fde8"],"technology":"langflow","known_exclusions":[],"conditions_summary":"# 1. Summary\n\n\nThe CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE).\n\n# 2. Description\n\n## 2.1 Intended Functionality\n\nWhen building a flow such as *ChatInput → CSVAgent → ChatOutput*, users can attach an LLM and specify a CSV file path. The CSV Agent then provides capabilities to query, summarize, or manipulate the CSV content using an LLM-driven agent.\n\n## 2.2 Root Cause\n\nIn `src/lfx/src/lfx/components/langchain_utilities/csv_agent.py`, the CSV Agent is instantiated as follows:\n\n```python\nagent_kwargs = {\n    \"verbose\": self.verbose,\n    \"allow_dangerous_code\": True,  # hardcoded\n}\nagent_csv = create_csv_agent(..., **agent_kwargs)\n```\n\nBecause `allow_dangerous_code` is hardcoded to `True`, LangChain automatically enables the `python_repl_ast` tool. Any LLM output that issues an action such as:\n\n```\nAction: python_repl_ast\nAction Input: **import**(\"os\").system(\"echo pwned > /tmp/pwned\")\n```\n\nis executed directly on the server.\n\nThere is no ","public_affected_ranges":["<= 1.8.0rc2"]}],"null_published_at":"2026-11-04T10:04:35.892Z","source_updated_at":"2026-10-27T17:28:26.000Z","source_disclosed_at":"2026-02-27T15:47:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00008882","kind":"vulnerability","title":"Langflow has Remote Code Execution in CSV Agent","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3645-fxcv-hqr4","CVE-2026-27966"],"plain_summary":"GitHub lists this reviewed advisory for langflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eaa0cfa816c061b9032e1e79b4a4a11"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T17:28:26.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-17683677363ed78c9c9d4a7b10a0fde8"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"35.246%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.98442. Missing scores are unknown.","source_id":"sr-0eaa0cfa816c061b9032e1e79b4a4a11"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-17683677363ed78c9c9d4a7b10a0fde8","url":"https://github.com/advisories/GHSA-3645-fxcv-hqr4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3645-fxcv-hqr4","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-0eaa0cfa816c061b9032e1e79b4a4a11","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-27966","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.376Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-17683677363ed78c9c9d4a7b10a0fde8"],"technology":"langflow","known_exclusions":[],"conditions_summary":"# 1. Summary\n\n\nThe CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE).\n\n# 2. Description\n\n## 2.1 Intended Functionality\n\nWhen building a flow such as *ChatInput → CSVAgent → ChatOutput*, users can attach an LLM and specify a CSV file path. The CSV Agent then provides capabilities to query, summarize, or manipulate the CSV content using an LLM-driven agent.\n\n## 2.2 Root Cause\n\nIn `src/lfx/src/lfx/components/langchain_utilities/csv_agent.py`, the CSV Agent is instantiated as follows:\n\n```python\nagent_kwargs = {\n    \"verbose\": self.verbose,\n    \"allow_dangerous_code\": True,  # hardcoded\n}\nagent_csv = create_csv_agent(..., **agent_kwargs)\n```\n\nBecause `allow_dangerous_code` is hardcoded to `True`, LangChain automatically enables the `python_repl_ast` tool. Any LLM output that issues an action such as:\n\n```\nAction: python_repl_ast\nAction Input: **import**(\"os\").system(\"echo pwned > /tmp/pwned\")\n```\n\nis executed directly on the server.\n\nThere is no ","public_affected_ranges":["<= 1.8.0rc2"]}],"null_published_at":"2026-10-31T22:13:44.237Z","source_updated_at":"2026-10-27T17:28:26.000Z","source_disclosed_at":"2026-02-27T15:47:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"}],"next_cursor":null,"snapshot_revision":"42594"}