Sploitus

Exploit for Eval Injection in Langflow

CVE-2026-0769

githubexploit · 2026-09-02

Exploit Code

README13 lines
## https://sploitus.com/exploit?id=20A07B7E-35D2-5D56-8B1A-C355139401C1
## Description


## Usage
`python3 poc.py -u  -c `

### Without bash command (proof of code exec via Divide By Zero Error)


### With bash command

**NOTE:** Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stored in _out within the build scope and isn't serialized into the JSON response, so the lack of command output doesn't mean the command wasn't executed.