CVE-2026-33017 Langflow RCE – isp.sh Dropper Execution via Python

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•12

Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.