Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-27 · source-backed
Langflow's CSV Agent node hardcodes allow_dangerous_code=True, exposing LangChain's python_repl_ast tool. Attackers inject prompts to execute arbitrary Python and OS commands without authentication. Patched in v1.8.0. This is the same eval() epidemic vulnerability class seen across agent workflow platforms — dangerous code execution shipped as default.
Each link below shares sources, entities, or timing with this story.
Check Point criticizes LangChain / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Check Point criticizes LangChain); both cover LangChain, Python; overlapping topics (agent, arbitrary, class).
Sysdig criticizes Langflow / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Sysdig criticizes Langflow); both cover Attackers, CVSS, Langflow, Python; overlapping topics (arbitrary, attacker, code).
Check Point criticizes LangChain / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Check Point criticizes LangChain); both cover CVE, CVSS; overlapping topics (code, cvss).
Check Point criticizes LangChain / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Check Point criticizes LangChain); both cover CVE, CVSS; overlapping topics (agent, authentication, code, cvss).
Flowise competes with Langflow / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Flowise competes with Langflow); both cover CVE, Python; overlapping topics (agent, arbitrary, command, execution).
LangSmith built by LangChain / Shared entities / Shared topic / What happened next
Linked by a graph relationship (LangSmith built by LangChain); both cover LangChain, Python; overlapping topics (agent, code).
MCP supports LangChain / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (MCP supports LangChain); both cover CVE, Patched; overlapping topics (arbitrary, code, command, cvss, execute).
LangChain partners with NVIDIA / Shared entity: Python / Shared topic / What happened next
Linked by a graph relationship (LangChain partners with NVIDIA); both cover Python; overlapping topics (agent, code).