1. Requests a superuser bearer token from /api/v1/auto_login (no auth).

2. Submits a payload to /api/v1/validate/code. The endpoint exec()s the code to "validate" it; Python evaluates default argument values at definition time, so the payload is wrapped in a function default argument:

   root@kitploit:~

   def _v(a=exec('<payload>')): pass
   

   For command execution the payload raises an exception whose message is the command output, which the endpoint reflects back in the response (function.errors[]).

Usage

Demo

Requirements

• Python 3.6+ (standard library only — no pip install needed)

Notes

• Works only while AUTO_LOGIN is enabled (the default for Langflow < 1.5; on >= 1.5 it must be explicitly LANGFLOW_AUTO_LOGIN=true). If auto_login returns no token, the target is not exploitable via this path — supply a valid token with -k if you have one.
• The command output is returned in the response function.errors[]; stderr is merged into stdout so failing commands still show their error.
• The code runs as the Langflow service user. If that is root (common with bare langflow run under systemd/Docker-as-root), this is direct host root.

Remediation

• Upgrade Langflow beyond the affected range; validate/code must not exec() untrusted input and auto_login must not mint superuser tokens.
• Set LANGFLOW_AUTO_LOGIN=false and configure real superuser credentials.
• Never run the Langflow service as root.

Disclaimer

This project is published for authorized security testing and educational purposes only. Do not use it against systems you do not own or have explicit permission to test. The author accepts no liability for misuse.