z4yd3/poc-cve-2026-33017Proof-of-concept exploit for CVE-2026-33017, demonstrating unauthenticated remote code execution in Langflow versions prior to 1.8.2 via the build_public_tmp API endpoint.
A critical code injection vulnerability exists in Langflow that allows an unauthenticated remote attacker to execute arbitrary Python code on the server. The vulnerability resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint. While this endpoint is designed to allow unauthenticated users to build "public flows," it incorrectly processes an optional data parameter. When this parameter is supplied, Langflow executes attacker-controlled flow definitions containing arbitrary Python code using the exec() function without any sandboxing or validation.
This proof-of-concept demonstrates Unauthenticated Remote Code Execution (RCE) in Langflow versions prior to 1.8.2. The vulnerability exists due to the application's willingness to accept and execute raw Python code provided within a "Custom Component" template via the build_public_tmp API endpoint.
TESTED ON LANGFLOW 1.8.2
https://github.com/user-attachments/assets/63358c33-0eca-49f4-84eb-542a5859dc0f
Usage: python3 script.py <url>
CVE-2026-33017 (MITRE): https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33017
Langflow GitHub Security Advisory: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx