CVE-2026-33475 - Vulnerability Analysis

Overview

Langflow < 1.9.0 contains a command injection vulnerability caused by unsanitized interpolation of GitHub context variables in GitHub Actions workflows, letting unauthenticated attackers execute arbitrary shell commands remotely via malicious branch names or pull request titles.

Severity & Score

Impact

Attackers can execute arbitrary commands in CI, exfiltrate secrets, manipulate infrastructure, and compromise the supply chain.

Mitigation

Update to Langflow version 1.9.0 or later which patches the vulnerability by sanitizing inputs and using environment variables.

References

• https://github.com/langflow-ai/langflow/security/advisories/GHSA-87cc-65ph-2j4w

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner