CVE-2026-33017

This repository contains a functional exploit for CVE-2026-33017, an unauthenticated RCE vulnerability in Langflow 1.8.1 and earlier. The exploit leverages the `/api/v1/build_public_tmp/{flow_id}/flow` endpoint to inject arbitrary Python code via crafted node configurations, executed via `exec()` without sandboxing.

This repository contains a functional Python exploit for CVE-2026-33017, targeting an unauthenticated RCE vulnerability in CTT Sovereign Echo. The exploit leverages a resonance gap in the flow builder endpoint to bypass sandboxing and execute arbitrary commands via an exec() sink.

This repository contains a functional exploit PoC for CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow <= 1.8.1. The exploit leverages the `build_public_tmp` endpoint to inject arbitrary code via the `data` parameter, which is executed via `exec()` without sandboxing.