Langflow — IBM’s open-source, low-code platform for building AI agent workflows, 140K+ GitHub stars — has a gaping hole. CVE-2026-33017: the public flow-build endpoint accepts user-supplied JSON, pulls Python code out of the node definitions, and feeds it straight into exec(). No auth, no sandbox. CVSS 9.8. One POST request, full server takeover.
Attackers needed 20 hours to weaponize it. Monero miners are now running on AI infrastructure, roughly 7,000 Langflow servers sit exposed on the internet, and CISA added it to the Known Exploited Vulnerabilities catalog. Running anything below 1.9.0? You’re the target.
Not just Langflow: 11 flaws, six frameworks
Same week, researchers disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. The worst: a CVSS 9.6 RCE in CrewAI, triggerable through prompt injection. The bugs are embarrassingly old-school — insecure deserialization, SSRF, path traversal. Stuff the industry fixed 20 years ago, now sitting under agents that read your inbox.
Why this matters
The Register’s verdict: prompt injection isn’t the bug — agent frameworks are. These frameworks run with your API keys and database access. An RCE here isn’t a demo, it’s your whole stack.
You Might Also Like
- Roguepilot Github Copilot 漏洞 the Prompt Injection That Turned Your ai Assistant Against you
- Alibabas Agentscope Hits 21k Github Stars What Makes This Multi Agent Framework Different
- Google Microsoft Salesforce Snowflake Servicenow Back one Agent Standard Aimed Straight at Anthropics mcp
- Google Skills Hits 16k Github Stars Google Adopts the Agent Format Anthropics Ecosystem Invented
- Google A2ui Agent to User Interface Finally a Standard way for ai Agents to Show you Things
Top AI Product 
Leave a comment