Exploit for Eval Injection in Langflow

CVE-2026-33017

githubexploit · 2026-03-27

Description

Exploit for eval injection in Langflow causes unauthenticated remote code execution.

Entry point

Parameterdata · request body

Path/api/v1/build_public_tmp/{flow_id}/flow

Unauthenticated endpoint accepts attacker-controlled flow data containing Python code, which is executed server-side without sandboxing (RCE).

Affected Langflow versions

Langflow< 1.8.2

All known vulnerabilities by product

Langflow

CVSS 9.8 for CVE-2026-33017

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

Working code

99%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

96.2%higher than 99.9% of all CVEs

Updated 2026-08-13

Exploit Details

Modified:2026-03-27 07:16

Last Seen:2026-03-27 07:37

Reporter:z4yd3

Written in:Python

Last commit:2026-03-27

Other exploits for CVE-2026-33017

langflow-CVE-2026-33017-poc

2026-09-08 KitPloitKITPLOIT

CVE-2026-33017-langflow-rce

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017-Langflow-RCE

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017-Langflow-RCE

2026-09-07 KitPloitKITPLOIT

CVE-2026-33017

2026-09-07 KitPloitKITPLOIT

PoC-CVE-2025-55182

2026-09-06 KitPloitKITPLOIT

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=EAF229D7-1FBB-5F73-995E-E0D21DE76D4B
# CVE-2026-33017-PoC
CVE-2026-33017: Unauthenticated RCE in Langflow

Exploit Code

Share

Share on social media: