CVE-2026-0770

This repository contains a functional exploit for CVE-2026-0770, a remote code execution vulnerability in Langflow's `validate_code()` function, which uses `exec()` on user-supplied Python code without sandboxing. The PoC leverages Python's default argument evaluation and generator `.throw()` to execute arbitrary commands and exfiltrate output via error responses.

This repository contains a functional exploit for CVE-2026-0770, a remote code execution vulnerability in Langflow's `validate_code()` function. The exploit leverages Python's `exec()` with a crafted payload using generator `.throw()` to execute arbitrary commands and exfiltrate output via error responses.

The repository contains a functional Python exploit for CVE-2026-0770, targeting Langflow's `/api/v1/validate/code` endpoint. The exploit leverages a vulnerability in the `validate_code()` function, which uses `exec()` on user-supplied code, allowing remote code execution (RCE).

The repository claims to exploit CVE-2026-0770 in Langflow via an RCE vulnerability but contains only an obfuscated Python script with no clear technical details or functional exploit code. The README lacks depth and pushes users to run the script without explanation.

This repository contains a functional Python exploit for CVE-2026-0770, targeting a remote code execution (RCE) vulnerability in Langflow's /api/v1/validate/code endpoint. The exploit leverages Python's generator exception handling to execute arbitrary commands via a crafted payload, with support for auto-login using default credentials.