Live › vulnerability › CVE-2026-109442
Go to dashboardpiflow 2.0.0 through 2.0.1 has POST /chat and POST /chat/stream endpoints with no authentication, and the DeepAgents agent behind them can call an exec_shell tool. An attacker who sends a prompt can make the agent run arbitrary shell commands and read environment variables such as LLM API keys and database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| piflow | vendor | >= 2.0.0, <= 2.0.1 | – |
v2.0.0 (f3b421c) and v2.0.1 (ad8d010) are affectedContent-Type: application/json -d {"message":"hi"}0.0.0.0 by default)v2.0.1 is the latest)127.0.0.1; restrict CORSEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-109442")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.