CVE-2026-0770-PoC

CVE-2026-0770 - Langflow リモートコード実行 概要 Langflow には、src/lfx/src/lfx/custom/validate.py にある validatecode 関数に重大なリモートコード実行の脆弱性が存在します。この関数は、サンドボックス化せずに exec を使用してユーザーが提供した Python コードを実行するため、サーバー上で任意のコマンド実行が可能になります。 影響を受けるバージョン Langflow 最新版（2026年2月7日時点） その他の CVE 関連する関数およびエンドポイントで同様の脆弱性が確認されています：...

CVE-2026-33017

CVE-2026-33017 - Langflow 인증되지 않은 원격 코드 실행 ⚠️ 면책 조항: 이 저장소는 승인된 보안 테스트 및 교육 목적으로만 제공됩니다. 소유하거나 명시적 테스트 권한이 있는 시스템에서만 사용하십시오. 저자는 이 도구의 오용이나 손해에 대해 책임지지 않습니다. 개요 CVE-2026-33017 은 LangChain 애플리케이션 구축을 위한 시각적 프레임워크인 Langflow의 인증되지 않은 원격 코드 실행 취약점입니다. POST /api/v1/buildpublictmp/flowid/flow 엔드포인트는 인증...

CVE-2026-82278

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

PT-2026-83301

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run once endpoint, which executes them with exec...

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Summary The POST /api/v1/buildpublictmp/flowid/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data containing arbitrary Python code in node definitions instead of the stored flow...