Exploit for Eval Injection in Langflow

CVE-2026-33017

githubexploit · 2026-07-04

Description

This describes an evaluation injection exploit in Langflow.

Entry point

Parameterdata · request body

Path/api/v1/build_public_tmp/{flow_id}/flow

Unauthenticated endpoint accepts attacker-controlled flow data containing Python code, which is executed server-side without sandboxing (RCE).

Affected Langflow versions

Langflow< 1.8.2

All known vulnerabilities by product

Langflow

CVSS 9.8 for CVE-2026-33017

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

Working code

31%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

96.2%higher than 99.9% of all CVEs

Updated 2026-09-08

Exploit Details

Modified:2026-07-04 11:29

Last Seen:2026-07-04 11:53

Reporter:yayip

Written in:Shell

Last commit:2026-07-04

Other exploits for CVE-2026-33017

langflow-CVE-2026-33017-poc

2026-09-08 KitPloitKITPLOIT

CVE-2026-33017-langflow-rce

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017-Langflow-RCE

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017-Langflow-RCE

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

PoC-CVE-2025-55182

2026-09-06 KitPloitKITPLOIT

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=65503DA9-CC18-52AD-A76E-53CDEFB7DB3F
PoC of Langflow CVE-2026-33017

Exploit Code

Share

Share on social media: