CVE-2026-27966

This repository contains a functional exploit tool for CVE-2026-27966, a critical RCE vulnerability in Langflow. The tool includes multi-threaded scanning, automatic detection, and interactive shell capabilities for remote command execution.

The repository contains a functional exploit tool for CVE-2026-27966, targeting a Remote Code Execution (RCE) vulnerability in Langflow. The tool includes features for scanning, detection, and exploitation, with support for multi-threading, proxy usage, and interactive shell access.

This Metasploit module exploits CVE-2026-27966, a vulnerability in Langflow's CSV Agent node that hardcodes allow_dangerous_code=True, enabling arbitrary Python and OS command execution via prompt injection. The exploit automates the creation of a malicious flow, uploads it, and triggers execution to achieve RCE.