Langflow's CSV Agent node hardcodes the parameter allow_dangerous_code=True, enabling LangChain's python_repl_ast tool. This allows remote attackers to execute arbitrary Python and OS commands on the server via crafted prompts, resulting in full remote code execution (RCE). There is no current configuration option to disable this behavior. Versions up to 1.8.0rc2 are affected. A proof of concept demonstrates creating a file on the server via this vulnerability.