Langflow exposes its CSV Agent node with a hardcoded flag that automatically enables a Python REPL tool. By injecting malicious prompts, an attacker can execute arbitrary Python or operating‑system commands on the server, granting full remote code execution. The flaw is a code injection vulnerability (CWE-94).

The vulnerability is present in the langflow‑ai langflow product in all releases prior to version 1.8.0. Users running Langflow 1.7.x or earlier are at risk.

The CVSS score of 9.8 marks the vulnerability as critical. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and it is not listed in CISA’s KEV catalog. The likely attack vector is a remote prompt injection into the CSV Agent node, which can be performed by anyone with the ability to add or modify a workflow that uses this node. Once exploited, the attacker can run arbitrary code on the host and potentially gain full system compromise.