CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human...

EUVD-2026-104682

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human...

CVE-2026-109442

The piflow software versions 2.0.0 through 2.0.1 contain a remote code execution (RCE) vulnerability within the DeepAgents chat agent . The issue stems from a lack of authentication on the POST /chat and POST /chat/stream endpoints. An unauthenticated attacker can instruct the agent to invoke the...