CVE-2026-33873 is a code injection flaw in Langflow, the tool for building AI agents. NVD scores it 9.9. Before 1.9.0, the Agentic Assistant executed model generated Python code during validation. Upgrade to Langflow 1.9.0. Treat any exposed Langflow instance as a high priority to update.
What's affected
Langflow before 1.9.0 is affected, and 1.9.0 fixes it. The record says the validation phase reaches dynamic execution and instantiates the generated class on the server. Exposure applies where an attacker can reach the Agentic Assistant feature and influence the model output.
How to check if you're exposed
pip show langflow
Compare with 1.9.0. Then check whether the Assistant feature is reachable by users you do not fully trust, and whether Langflow is exposed outside your network.
What to do now
- Upgrade Langflow to 1.9.0 or later.
- Restrict network access to Langflow and require authentication.
- Run Langflow with minimal permissions and without cloud credentials in its environment.
- Review the host for unexpected processes or files.
Why it matters
The record uses CWE-94, code injection. Model output is untrusted input. Running it, even to validate it, executes whatever it contains. Validate generated code by parsing it, not by loading and instantiating it. The record is not marked as exploited in the wild and is not in CISA KEV.
AI agent tooling is moving fast, and features that run model output are becoming common. Each one deserves a review with one question: what happens if the model says something hostile? If the answer is that the server runs it, the feature needs a sandbox or a different design. When you evaluate agent frameworks, ask which components execute generated code and how they are isolated.
If you cannot upgrade today, take the Assistant feature out of reach. Put Langflow behind authentication and a network allowlist, and make sure no one outside your team can send it prompts. Record which flows and credentials the server can reach, because that list is what an attacker would inherit if the host were compromised.
Quick check
Why is validation risky here?
The record says validation instantiated the generated class, which runs its code.
Sources
Last reviewed: 19 October 2026.
