CVE-2026-0770

This exploit demonstrates an unauthenticated remote code execution vulnerability in Langflow 1.2.0 by abusing the `exec_globals` parameter in the `/api/v1/validate/code` endpoint. It leverages Python's `subprocess.run` to execute arbitrary commands, with support for both authenticated and unauthenticated exploitation paths.

This repository contains a functional exploit for CVE-2026-0770, a remote code execution vulnerability in Langflow's `validate_code()` function, which uses `exec()` on user-supplied Python code without sandboxing. The PoC leverages Python's default argument evaluation and generator `.throw()` to execute arbitrary commands and exfiltrate output via error responses.

This repository contains a functional exploit for CVE-2026-0770, a remote code execution vulnerability in Langflow's `validate_code()` function. The exploit leverages Python's `exec()` with a crafted payload using generator `.throw()` to execute arbitrary commands and exfiltrate output via error responses.

This repository contains a functional proof-of-concept exploit for CVE-2026-0770, a critical unauthenticated remote code execution vulnerability in Langflow's `/api/v1/validate` endpoint. The exploit leverages unsanitized `exec_globals` parameter injection to execute arbitrary commands via Python's `exec()` function.

This PoC exploits a critical RCE vulnerability in Langflow's `/api/v1/validate/code` endpoint by leveraging `exec()` on user-supplied Python code with malicious default arguments. The exploit bypasses authentication using default credentials (langflow/langflow) and executes arbitrary commands via subprocess.run().

This repository contains a functional exploit for CVE-2026-0770, targeting Langflow < 1.3.0. The exploit leverages the `validate_code()` endpoint's `exec()` functionality to achieve remote code execution (RCE) via crafted Python code injection. It supports both authenticated and unauthenticated exploitation paths.

This repository contains a functional exploit for CVE-2026-0770, demonstrating remote code execution in Langflow via the `/api/v1/validate/code` endpoint. The exploit leverages Python's `exec()` function with a crafted payload that executes arbitrary commands through default argument evaluation.

This repository contains a functional Python exploit for CVE-2026-0770, an unauthenticated RCE vulnerability in Langflow. The exploit leverages improper input validation in the `/validate` endpoint's `exec_globals` parameter to execute arbitrary commands as the `root` user.

The repository contains a functional Python exploit for CVE-2026-0770, targeting Langflow's `/api/v1/validate/code` endpoint. The exploit leverages a vulnerability in the `validate_code()` function, which uses `exec()` on user-supplied code, allowing remote code execution (RCE).

The repository claims to exploit CVE-2026-0770 in Langflow via an RCE vulnerability but contains only an obfuscated Python script with no clear technical details or functional exploit code. The README lacks depth and pushes users to run the script without explanation.

This repository contains a functional Python exploit for CVE-2026-0770, targeting a remote code execution (RCE) vulnerability in Langflow's /api/v1/validate/code endpoint. The exploit leverages Python's generator exception handling to execute arbitrary commands via a crafted payload, with support for auto-login using default credentials.