Exploit for Eval Injection in Langflow

CVE-2026-33017

githubexploit · 2026-08-13

Description

Eval injection in Langflow allows arbitrary code execution via crafted input.

Entry point

Parameterdata · request body

Path/api/v1/build_public_tmp/{flow_id}/flow

Unauthenticated remote code execution via public flow build endpoint that accepts attacker-controlled flow data executed on the server (exec with no sandbox).

Affected Langflow versions

Langflow< 1.8.2

All known vulnerabilities by product

Langflow

CVSS 9.8 for CVE-2026-33017

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

Working code

95%confidence this exploit runs

Based on 1 file(s) in the source

Exploit Details

Modified:2026-08-13 13:46

Last Seen:2026-08-13 13:50

Reporter:sonnelon

Written in:Python

Last commit:2026-08-13

Other exploits for CVE-2026-33017

Exploit for Eval Injection in Langflow

2026-08-13 lxxexxbxxGITHUB

📄 Langflow Remote Code Execution

2026-08-11 Richard Howe, DiamorphinePACKETSTORMRuby

Exploit for Eval Injection in Langflow

2026-08-05 TatoSecGITHUB

Exploit for Eval Injection in Langflow

2026-07-23 Dynamo2k1GITHUB

Exploit for Eval Injection in Langflow

2026-07-19 CerberusMrXiGITHUB

Exploit for Eval Injection in Langflow

2026-07-16 Industri4l-H3ll-Xpl0it3rsGITHUB

Langflow 1.9.0 - RCE

2026-07-08 DiamorphineEXPLOITDBPython

Exploit for Eval Injection in Langflow

2026-07-04 yayipGITHUB

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=F54C4C3A-AF7F-5FA1-902D-3BDB0D1C35CD
The poc of CVE-2026-33017

Exploit Code

Share

Share on social media: