shinthink/CVE-2026-27966

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based scanner that detects Langflow instances vulnerable to CVE-2026-27966 and optionally attempts to exploit them for remote code execution. It includes a detection-only mode (--no-exploit) and primarily functions as a mass-scanning tool.

Backdoor review

No backdoor observed in reviewed code

The repository contains a public proof-of-concept (PoC) scanner and exploit for CVE-2026-27966. The Python script (cve_2026_27966.py) implements documented vulnerability detection and exploitation techniques (route injection, vertex injection, CSV Agent prompt injection) against Langflow instances. No concealed backdoor, unrelated payload, or operator-directed harm (e.g., credential theft, persistence, C2) was observed. The code performs only the advertised security testing actions.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareLangflow
Attack typesRemote Code ExecutionPrompt InjectionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a scanner. The README explicitly titles it a 'Scanner' (line 8) and the code includes a '--no-exploit' flag that performs detection only (lines 146-147, 160, 244-257). While the code also contains exploitation logic, its design as a mass-scanning tool with a detection-only mode and its self-description as a scanner indicate its primary purpose is scanning.

README.md:8cve_2026_27966.py:146-147cve_2026_27966.py:244-257

Requirements

  • Target must be running a vulnerable version of Langflow (< 1.8.0).cve_2026_27966.py:91-96
  • Target must have an unauthenticated API endpoint for custom component registration or build vertex injection.cve_2026_27966.py:98-105

Observed behavior

  • Sends HTTP GET requests to /api/v1/version to detect Langflow and its version.cve_2026_27966.py:63-89
  • Checks if the target requires an API key by attempting to POST to /api/v1/custom_component.cve_2026_27966.py:98-105
  • Attempts to obtain an API key via the auto_login endpoint.cve_2026_27966.py:109-136
  • Attempts remote code execution by registering a backdoor FastAPI route via /api/v1/custom_component and then calling it with a command.cve_2026_27966.py:140-186
  • Attempts remote code execution by injecting a malicious vertex into a flow via /api/v1/build/{uuid}/vertices and then running the flow.cve_2026_27966.py:187-208
  • Attempts remote code execution via CSV Agent prompt injection by sending a crafted prompt to /api/v1/run/{fid}.cve_2026_27966.py:210-216
  • Supports a --no-exploit flag that skips all RCE attempts and only reports vulnerability status.cve_2026_27966.py:244-257
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
Route injection via custom_component endpointThe script registers a backdoor FastAPI route on the target to achieve RCE, as described in the README.cve_2026_27966.py:144-149
Exploit Technique
Build vertex injection and flow executionThe script injects a malicious vertex into a flow and triggers execution to achieve RCE.cve_2026_27966.py:196-208
Exploit Technique
CSV Agent prompt injectionThe script attempts prompt injection against CSV Agent flows to execute Python code.cve_2026_27966.py:211-216
Network Behavior
Outbound HTTP requests to user-supplied targetsThe script sends HTTP requests to the specified target(s) to detect and exploit the vulnerability.cve_2026_27966.py:52-59
Review boundaries

What the analysis did not establish

  • One file (unclassified, 70 bytes) was not included in the evidence packet; its content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository were provided.
  • One file (unclassified, 70 bytes) was omitted from text review; its metadata-only analysis shows no executable content, but its contents are unverified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1