Code injection in Langflow
CVSS score
9.8
EPSS probability
%24.8
Risk score
4.9
Published
6 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: Langflow < 1.9.0 - Remote Code Execution
CVE-2026-33017 PoC Reverse Shell
Proof-of-concept for CVE-2026-33017, demonstrating unauthenticated remote code execution in vulnerable Langflow versions through malicious CustomComponent code injection.
CVE-2026-33017 - Langflow Unauthenticated RCE Exploit
https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
CVE-2026-33017: Langflow Unauthenticated RCE PoC
Simple Proof Of Concept about CVE 2026-33017
CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine.
https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896
Similar Vulnerabilities
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Vulnerability in Langflow
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
Vulnerability in Langflow
Code injection in Langflow
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-33017"