Remote Code Execution in Langflow CSV Agent via python_repl_ast Exposure

Repository contains a standalone Python exploit/scanner for CVE-2026-27966 affecting Langflow versions prior to 1.8.0. Structure is minimal: one main Python script (cve_2026_27966.py), a README with exploitation details and usage examples, requirements.txt, and .gitignore. The script is not part of a larger exploitation framework. Primary capability: identify Langflow instances, determine likely vulnerability status from version information, test whether API access is protected, attempt auto_login token acquisition, and if exploitation is enabled pursue remote code execution. The README describes three exploitation paths: (1) route injection via /api/v1/custom_component to register a malicious FastAPI route, (2) direct route injection without API key where allowed, and (3) build/vertex injection using exposed flow UUIDs and unauthenticated build/run endpoints. It also references CSV Agent prompt injection through LangChain's python_repl_ast tool as an additional RCE mechanism. Observed code behavior from the available script portion: it imports requests/urllib3, disables TLS warnings, randomizes User-Agent strings, supports single-target and mass-scan modes, and uses argparse for CLI handling. Detection logic probes both HTTPS and HTTP, checks /api/v1/version for Langflow fingerprints, falls back to /health, and marks versions < 1.8 as vulnerable. It also probes /api/v1/custom_component to infer whether an API key is required and attempts /api/v1/auto_login to obtain credentials or tokens. The exploit is operational rather than a simple detector because it is explicitly designed to move beyond fingerprinting into command execution. The payload described in the repository is a Python FastAPI route that executes shell commands via os.popen and returns output over HTTP, enabling persistent in-memory backdoor access until restart. The repository’s purpose is therefore offensive security testing of exposed Langflow instances, with both reconnaissance and exploitation workflows, including concurrent mass scanning.

Repository contains a single Python exploit tool (langflow.py) plus a README. The tool is an all-in-one network exploit targeting alleged Langflow RCE (CVE-2026-27966). It supports single-target and mass scanning (threaded), automatic detection of Langflow instances, optional automatic flow creation (to obtain a flow_id when missing), and then remote command execution against the target via Langflow’s HTTP API. Post-exploitation capability is an interactive command loop (“interactive shell”) that repeatedly sends attacker-supplied OS commands and prints cleaned output. Key capabilities implemented in code: - HTTP client with User-Agent rotation and optional proxy support (proxy list loaded from a local file). - Multi-threaded scanning of many targets from an input file; tracks counts of scanned/langflow/vulnerable and stores exploited results. - Exploitation workflow: detect instance → obtain/create flow_id → send crafted request to execute a command → parse/clean response output. - Operator features: debug logging, save vulnerable URLs to an output file, run a single command or interactive shell. Notable endpoints/targets: - The exploit primarily targets user-supplied base URLs (e.g., http(s)://<host>:7860). The README provides example targets and file names (targets.txt). The code also references local file paths for proxy lists and output results. (The specific Langflow API paths used for detection/flow creation/command execution are not visible in the provided truncated snippet, but the structure clearly indicates multiple endpoint checks and a flow-based RCE trigger.)