CVE-2026-109442 Details

A remote code execution vulnerability has been identified in piflow versions 2.0.0 through 2.0.1. The issue resides in the DeepAgents chat agent, specifically within the POST /chat and POST /chat/stream endpoints, which lack authentication. This vulnerability allows attackers to command the agent to execute arbitrary shell commands using the exec_shell tool. The commands are run via subprocess.run, without any human approval or allow-list, exposing sensitive environment secrets such as LLM API keys and database credentials.

To address this vulnerability, it is recommended to require authentication for the POST /chat and POST /chat/stream endpoints. This can be done by adding a global authentication middleware or by using the Depends(get_current_user) pattern already implemented in other parts of the application. Additionally, the exec_shell tool should be executed within a real sandbox environment, such as a container or microVM, with no access to the host filesystem or network. CORS settings should be tightened, and the application should be bound to localhost unless intentional network exposure is needed.