CVE-2026-33475
Shell Injection in Langflow GitHub Actions Allows Secret Exfiltration
Publication date: 2026-03-24
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langflow | langflow | to 1.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33475 is a critical unauthenticated remote shell injection vulnerability in multiple GitHub Actions workflows of the Langflow repository prior to version 1.9.0.
The issue arises because GitHub context variables like `${{ github.head_ref }}` or `${{ github.event.pull_request.title }}`, which can contain user-controlled input such as branch names or pull request titles, are directly interpolated into shell commands in `run:` steps without proper quoting or sanitization.
This allows an attacker to inject and execute arbitrary shell commands during CI/CD execution by crafting malicious branch names or pull request titles.
For example, an attacker can create a branch named with shell commands that exfiltrate secrets like the `GITHUB_TOKEN` when the workflow runs.
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution within the CI environment, allowing attackers to gain full access to CI secrets such as the `GITHUB_TOKEN`.
- Exfiltration of sensitive secrets and tokens.
- Manipulation of infrastructure by pushing malicious tags or images.
- Tampering with software releases.
- Supply chain compromise during CI/CD execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by inspecting the GitHub Actions workflows in the Langflow repository for unsanitized interpolation of GitHub context variables directly inside `run:` shell command steps.'}, {'type': 'paragraph', 'content': 'Specifically, look for usage of variables like `${{ github.head_ref }}`, `${{ github.event.pull_request.title }}`, or custom inputs interpolated directly in `run:` commands without proper quoting or sanitization.'}, {'type': 'paragraph', 'content': 'A practical detection method is to review the workflow YAML files in `.github/workflows/` and `.github/actions/` for lines similar to:'}, {'type': 'list_item', 'content': 'run: echo "Branch: ${{ github.head_ref }}"'}, {'type': 'list_item', 'content': 'run: npx playwright install ${{ inputs.browsers }} --with-deps'}, {'type': 'paragraph', 'content': 'Since this vulnerability involves shell injection via malicious branch names or pull request titles, you can also monitor your CI logs for unexpected shell commands or network calls triggered by such inputs.'}, {'type': 'paragraph', 'content': 'There are no specific detection commands provided, but reviewing workflow files for direct interpolation of user-controlled variables in `run:` steps is the key detection approach.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability immediately, refactor the affected GitHub Actions workflows to avoid direct interpolation of user-controlled variables inside `run:` shell command steps.'}, {'type': 'paragraph', 'content': 'Instead, assign these variables to environment variables and wrap them in double quotes to ensure proper sanitization and prevent shell injection.'}, {'type': 'list_item', 'content': 'Use environment variables like: `env: BRANCH_NAME: ${{ github.head_ref }}`'}, {'type': 'list_item', 'content': 'Modify `run:` steps to reference these environment variables with proper quoting, for example: `echo "Branch is: \\"$BRANCH_NAME\\""`'}, {'type': 'paragraph', 'content': 'Additionally, upgrade Langflow to version 1.9.0 or later, where this vulnerability has been patched.'}, {'type': 'paragraph', 'content': 'Avoid using unsanitized user-controlled inputs directly in shell commands within workflows.'}] [1]