rmhowe425/poc-cve-2026-0769Proof-of-concept exploit for CVE-2026-0769 in Langflow, allowing remote code execution via crafted requests. Demonstrates code execution with or without a bash command.
Proof of concept exploit code for CVE-2026-0769
python3 poc.py -u <Langflow URL> -c <Bash Command>
NOTE: Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stored in _out within the build scope and isn't serialized into the JSON response, so the lack of command output doesn't mean the command wasn't executed.
