CVE-2026-0768
Qualys 위협 인텔 · 심각도 5/5 · QID 735405 · CGI
공개 익스플로잇
측면이동
쉬운 악용
대량 데이터 유출
서비스 거부
패치 없음
웜 전파
인증 불필요
원격코드실행
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-27322.
The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-27322.
타임라인
- NVD 공개
- 첫 보도 The Hacker News · 공격자들이 자격 증명 탐색 및 C2 활동에서 Langflow와 Rails의…
- 최근 보도 (총 5건) Rapid7 Blog · Metasploit 총정리: Langflow, MongoDB 등
날짜 정보 없는 신호: 공개 PoC 2건 웜 전파
벡터: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
공개 익스플로잇 / PoC
- GitHub 공개 PoC 2건 — 대표 레포 ↗