{
 "schema_version": "0.4",
 "id": "REG-0037",
 "title": "piflow: anyone who can reach the unauthenticated chat endpoints can tell the DeepAgents chat agent to run shell commands, which its exec_shell tool executes with no human approval or allow-list; CVE published 20 October 2026",
 "batch": "agent-2026-10-20",
 "family": "software",
 "context": {
  "domain": "Software agent (DeepAgents chat agent in the piflow server, with an exec_shell tool)",
  "autonomy_level": "alone",
  "autonomy_level_text": "The agent calls exec_shell, which runs commands via subprocess.run without human approval, so no person decides the command",
  "actor_type": "Software: the DeepAgents chat agent in piflow 2.0.0 through 2.0.1",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as an unauthenticated caller of POST /chat or POST /chat/stream",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported",
  "jurisdiction": [
   "Global (open-source project)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "CVE record assigned by VulnCheck (the CVE numbering authority) and recorded in the NVD (National Vulnerability Database), where its status is now Deferred (not scheduled for NVD's own analysis); VulnCheck's advisory and the Lasso Security entry describe the flaw, and the project's code at the referenced commit shows the mechanism; Lasso reports no known exploit",
 "status": "confirmed",
 "status_text": "Confirmed (corroborated by the project's own code; no fix released as of 21 October 2026; no exploitation reported)",
 "outcome": {
  "state": "pending",
  "severity": "none reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "The DeepAgents chat agent in piflow 2.0.0 through 2.0.1, with an exec_shell tool",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Chat messages sent by an unauthenticated attacker to POST /chat or POST /chat/stream, instructing the agent to call exec_shell",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109442",
    "LASSO-109442"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins [\"*\"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109442",
    "REPO-PIFLOW"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "The agent runs arbitrary commands on the host, exposing environment secrets such as LLM API keys and database credentials",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: pending (no fix has shipped). No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109442",
    "LASSO-109442"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "CVE-2026-109442 (Common Vulnerabilities and Exposures entry) reserved 12 October 2026 and published 20 October 2026 by VulnCheck as the CNA (CVE numbering authority); the record gives 15 October 2026 as the date the flaw was made public and credits Noy Pearl, Michael Sromin and Ophir Dror as finders. VulnCheck scored it CVSS (Common Vulnerability Scoring System) 4.0 base 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and CVSS 3.1 base 9.8; weakness CWE-306. The record references piflow source at commit ad8d010 (agents/tools.py and server.py), the Lasso Security entry (tagged technical description and exploit) and VulnCheck's advisory, dated 19 October 2026",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-109442",
    "CVE-ORG-109442",
    "VULNCHECK-109442"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "assertion_type": "assertion",
   "source_ids": [
    "LASSO-109442",
    "REPO-PIFLOW"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-109442"
   ],
   "confidence": "low",
   "disputed": false
  }
 ],
 "inference": {
  "value": "Any caller who could reach the chat endpoints could direct the agent, and the agent could run any command; neither the caller nor the command was checked. The record does not show an attack, a fixed release, or a chat message carried through the model to a command: the published reproduction calls exec_shell directly on a local copy.",
  "source_ids": [
   "NVD-109442",
   "LASSO-109442",
   "REPO-PIFLOW"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [],
  "succeeded": [],
  "absent": [
   {
    "id": "C-A1",
    "note": "Mechanism: POST /chat and POST /chat/stream accept instructions for the agent from any caller, with no authentication. Why it interrupts: if the endpoints established the caller's identity by credential, an unauthenticated attacker's instruction would never reach the agent. Source shows it absent: the record states the endpoints lack authentication (CWE-306).",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-E3",
    "note": "Mechanism: exec_shell runs the commands the agent is told to run without human approval. Why it interrupts: a confirmation step before command execution would put a human decision between the attacker's message and the host command. Source shows it absent: the record states exec_shell runs commands without human approval.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-M2",
    "note": "Mechanism: exec_shell runs arbitrary commands, with no allow-list. Why it interrupts: an enforced allow-list would refuse commands outside the agent's task, such as reading environment secrets. Source shows it absent: the record states there is no allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown.",
    "confidence": "medium",
    "basis": "agent"
   }
  ]
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "piflow",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null
   }
  }
 ],
 "sources": {
  "NVD-109442": {
   "title": "NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109442",
   "date": "2026-10-20",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "LASSO-109442": {
   "title": "Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool",
   "type": "researcher",
   "url": "https://www.lasso.security/vulnerability-database/cve-2026-109442",
   "date": null,
   "tier": "researcher",
   "interest": "Security vendor that publishes the database entry",
   "primary": false,
   "checked": "2026-10-21"
  },
  "CVE-ORG-109442": {
   "title": "CVE record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell",
   "type": "public_record",
   "url": "https://www.cve.org/CVERecord?id=CVE-2026-109442",
   "date": "2026-10-20",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "VULNCHECK-109442": {
   "title": "VulnCheck advisory: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell",
   "type": "researcher",
   "url": "https://www.vulncheck.com/advisories/piflow-2.0.0-through-2.0.1-unauthenticated-rce-via-chat-agent-exec-shell",
   "date": "2026-10-19",
   "tier": "researcher",
   "interest": "CVE numbering authority that assigned the CVE; sells vulnerability intelligence",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REPO-PIFLOW": {
   "title": "cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag",
   "type": "company",
   "url": "https://github.com/cas-bigdatalab/piflow",
   "date": "2026-07-31",
   "tier": "company",
   "interest": "maintainer's own code",
   "primary": true,
   "checked": "2026-10-22",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "sources.CVE-ORG-109442",
   "old": null,
   "new": "{\"title\": \"CVE record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell\", \"type\": \"public_record\", \"url\": \"https://www.cve.org/CVERecord?id=CVE-2026-109442\", \"date\": \"2026-10-20\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE Program's record (read as JSON from cveawg.mitre.org) gives the reservation date (12 October 2026), the date the flaw was made public (15 October 2026) and the three credited finders, none of which the NVD copy carries."
  },
  {
   "date": "2026-10-21",
   "field": "sources.VULNCHECK-109442",
   "old": null,
   "new": "{\"title\": \"VulnCheck advisory: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell\", \"type\": \"researcher\", \"url\": \"https://www.vulncheck.com/advisories/piflow-2.0.0-through-2.0.1-unauthenticated-rce-via-chat-agent-exec-shell\", \"date\": \"2026-10-19\", \"tier\": \"researcher\", \"interest\": \"CVE numbering authority that assigned the CVE; sells vulnerability intelligence\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the VulnCheck advisory the CVE record cites, which the drafting run could not open, was read; it is dated 19 October 2026, gives CVSS 4.0 9.3 and credits Noy Pearl, Michael Sromin and Ophir Dror."
  },
  {
   "date": "2026-10-21",
   "field": "sources.REPO-PIFLOW",
   "old": null,
   "new": "{\"title\": \"cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag\", \"type\": \"company\", \"url\": \"https://github.com/cas-bigdatalab/piflow\", \"date\": \"2026-07-31\", \"tier\": \"company\", \"interest\": \"maintainer's own code\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's repository, read by git clone, shows the default configuration (all-interface bind, any-origin cross-origin setting), the human-approval setting that omits exec_shell, and that no fix exists on any branch as of 21 October 2026."
  },
  {
   "date": "2026-10-21",
   "field": "sources.NVD-109442.title",
   "old": "NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1, unauthenticated POST /chat and /chat/stream let callers make the DeepAgents chat agent run exec_shell commands without human approval or allow-list, CVSS 4.0 9.3",
   "new": "NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell",
   "reason": "Found in the editor's source check of 21 October 2026: the drafted title was a description; the record's title, set by the CVE numbering authority VulnCheck, is 'piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell' (CVE record and NVD API)."
  },
  {
   "date": "2026-10-21",
   "field": "sources.LASSO-109442.title",
   "old": "Lasso Security vulnerability database entry CVE-2026-109442 (piflow): no known exploit; reproduced on a local clone at commit 817605d; remediation recommendations",
   "new": "Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool",
   "reason": "Found in the editor's source check of 21 October 2026: the drafted title was a description; the Lasso Security page's headline is 'CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool'."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier_text",
   "old": "CVE record assigned by VulnCheck (CNA) and recorded in NVD (status Received); the VulnCheck advisory it references could not be opened in this run; a Lasso Security database entry restates the flaw and reports no known exploit",
   "new": "CVE record assigned by VulnCheck (the CVE numbering authority) and recorded in the NVD (National Vulnerability Database), where its status is now Deferred (not scheduled for NVD's own analysis); VulnCheck's advisory and the Lasso Security entry describe the flaw, and the project's code at the referenced commit shows the mechanism; Lasso reports no known exploit",
   "reason": "Found in the editor's source check of 21 October 2026: the VulnCheck advisory, which the drafting run could not open, was read (vulncheck.com, dated 19 October 2026); the NVD API shows the record's status changed from Received to Deferred on 20 October 2026 (lastModified 2026-10-20T20:11:29); the piflow repository at commit ad8d010 was read."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (CNA advisory not read in this run; no fix named in the sources; no exploitation reported)",
   "new": "Provisional (CNA (CVE numbering authority) advisory read 21 October 2026; no fix released as of 21 October 2026; no exploitation reported)",
   "reason": "Found in the editor's source check of 21 October 2026: the VulnCheck advisory has now been read; the piflow repository shows no release after v2.0.1 (31 July 2026) and no change to exec_shell or chat-route authentication on any branch."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 4.0 9.3)",
   "new": "none reported. Severity scores assigned by VulnCheck, the CVE numbering authority: CVSS (Common Vulnerability Scoring System, a severity score) 4.0 base score 9.3, Critical; CVSS 3.1 base score 9.8, Critical",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record and NVD API list both scores with source disclosure@vulncheck.com (VulnCheck, the CVE numbering authority): CVSS 4.0 base 9.3 and CVSS 3.1 base 9.8, both Critical; NVD has added no score of its own. The case did not say who assigned the score."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Decision.value",
   "old": "The agent follows the instruction and calls exec_shell",
   "new": "Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record says attackers 'can instruct the agent to call the exec_shell tool' (a capability, not an observed act); the Lasso Security entry's proof of concept is a placeholder prompt, and its reproduction is 'invoking the verbatim exec_shell' with test commands plus a static scan of the routes. The drafted value stated as fact that the agent follows the instruction."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Decision.assertion_type",
   "old": "fact",
   "new": "assertion",
   "reason": "Found in the editor's source check of 21 October 2026: the model complying with a chat message is described by VulnCheck (CVE record) and Lasso Security, not shown in any primary record; downgraded from fact."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Decision.confidence",
   "old": "high",
   "new": "medium",
   "reason": "Found in the editor's source check of 21 October 2026: same as above: the end-to-end path through the model is described, not demonstrated in the sources."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Decision.source_ids",
   "old": "[\"NVD-109442\"]",
   "new": "[\"NVD-109442\", \"LASSO-109442\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the Lasso Security entry is the source for what its reproduction did and did not show."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints.value",
   "old": "The chat endpoints lack authentication (CWE-306); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list",
   "new": "The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins [\"*\"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person",
   "reason": "Found in the editor's source check of 21 October 2026: the piflow repository at commit ad8d010 (tag v2.0.1), and identically at v2.0.0, hard-codes host '0.0.0.0' in server.py's uvicorn.run calls, sets CORSMiddleware allow_origins=['*'], and in agents/factory.py sets interrupt_on to write_file, read_file and edit_file, all False, with exec_shell absent; the Lasso Security entry says the same ('listens on all network interfaces with permissive CORS by default'). The case omitted the default configuration."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints.source_ids",
   "old": "[\"NVD-109442\"]",
   "new": "[\"NVD-109442\", \"REPO-PIFLOW\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the default configuration and human-approval setting come from the maintainer's code."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome.value",
   "old": "State: averted by disclosure. No exploitation reported in the sources; Lasso Security lists no known exploit and reports reproduction on a local clone at commit 817605d. As of Oct 2026.",
   "new": "State: averted by disclosure. No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: the Lasso Security entry's reproduction is 'invoking the verbatim exec_shell' with benign canaries and 'A static AST scan' of the routes, not a chat request carried end to end; the CVE record and NVD API carry CISA's SSVC (Stakeholder-Specific Vulnerability Categorization) enrichment of 20 October 2026: Exploitation 'poc', Automatable 'yes', Technical Impact 'total'. The case did not say what was reproduced or give CISA's rating."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event.value",
   "old": "CVE-2026-109442 published 20 October 2026 by the VulnCheck CNA; CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), CVSS 3.1 9.8; CWE-306; references piflow source at commit ad8d010 (agents/tools.py and server.py) and a VulnCheck advisory",
   "new": "CVE-2026-109442 (Common Vulnerabilities and Exposures entry) reserved 12 October 2026 and published 20 October 2026 by VulnCheck as the CNA (CVE numbering authority); the record gives 15 October 2026 as the date the flaw was made public and credits Noy Pearl, Michael Sromin and Ophir Dror as finders. VulnCheck scored it CVSS (Common Vulnerability Scoring System) 4.0 base 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and CVSS 3.1 base 9.8; weakness CWE-306. The record references piflow source at commit ad8d010 (agents/tools.py and server.py), the Lasso Security entry (tagged technical description and exploit) and VulnCheck's advisory, dated 19 October 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record (cveawg.mitre.org JSON) gives dateReserved 2026-10-12, datePublished 2026-10-20, datePublic 2026-10-15 and credits three finders, and tags the Lasso Security reference 'technical-description' and 'exploit'; the VulnCheck advisory is dated 10/19/2026 and credits the same finders. The drafted value omitted the finders and the disclosure timeline and truncated the CVSS 4.0 vector."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"NVD-109442\"]",
   "new": "[\"NVD-109442\", \"CVE-ORG-109442\", \"VULNCHECK-109442\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the finders, reservation date and public date come from the CVE record and the VulnCheck advisory."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.value",
   "old": "No fixed version is named in the sources. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox, restricting CORS and network binding, and taking exposed deployments off the network or behind authentication",
   "new": "No fixed version is named in the sources. As of 21 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commit on any branch (cross_dag_172, 17 October 2026) keeps exec_shell and its human-approval setting unchanged and the chat routes still without an authentication check; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "reason": "Found in the editor's source check of 21 October 2026: the piflow repository (git clone fetched 21 October 2026) has master at ad8d010 = tag v2.0.1 (31 July 2026) and no later tag; branch cross_dag_172 (commit 55580007, 17 October 2026) has agents/tools.py and agents/factory.py identical to master and routers/chat_router.py '/chat' and '/chat/stream' with no authentication dependency. The Lasso Security remediation list also includes a minimal environment, a command allow-list, human-approval gating and treating uploads as untrusted, which the drafted summary left out."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"LASSO-109442\"]",
   "new": "[\"LASSO-109442\", \"REPO-PIFLOW\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the repository is the primary record for whether a fix exists."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Any caller who could reach the endpoint could direct the agent, and the agent could run any command; neither the caller nor the command was checked.",
   "new": "Any caller who could reach the chat endpoints could direct the agent, and the agent could run any command; neither the caller nor the command was checked. The record does not show an attack, a fixed release, or a chat message carried through the model to a command: the published reproduction calls exec_shell directly on a local copy.",
   "reason": "Found in the editor's source check of 21 October 2026: the interpretation did not say what the record does not show (runbook rule 18): no source reports an attack, the repository has no fixed release as of 21 October 2026, and the Lasso Security reproduction calls exec_shell directly rather than through a chat request. Not signed, so no signature was reset."
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"NVD-109442\"]",
   "new": "[\"NVD-109442\", \"LASSO-109442\", \"REPO-PIFLOW\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the added sentence rests on the Lasso Security entry and the repository."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.state",
   "old": "averted_by_disclosure",
   "new": "pending",
   "reason": "Editor's call H1 of 21 October 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier",
   "old": "disclosure_uncorroborated",
   "new": "disclosure_corroborated",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism."
  },
  {
   "date": "2026-10-21",
   "field": "status",
   "old": "provisional",
   "new": "confirmed",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (CNA (CVE numbering authority) advisory read 21 October 2026; no fix released as of 21 October 2026; no exploitation reported)",
   "new": "Confirmed (corroborated by the project's own code; no fix released as of 21 October 2026; no exploitation reported)",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026.",
   "new": "State: pending (no fix has shipped). No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026.",
   "reason": "Follows the editor's call H1 of 21 October 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the sources. As of 21 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commit on any branch (cross_dag_172, 17 October 2026) keeps exec_shell and its human-approval setting unchanged and the chat routes still without an authentication check; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "new": "No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated up to 22 October 2026) change only files under scientific_agents/dataset_qa/, leaving exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "reason": "Found in an independent re-read of 22 October 2026 of the claims changed that day: branch cross_dag_172 has commits dated 19, 20 and 22 October 2026 (head 9a49ac9), so '17 October 2026' was no longer the newest commit. Every file those commits change since 5558000 (17 October) is under scientific_agents/dataset_qa/; nothing under agents/ or the server changed, so the finding holds (git fetch of https://github.com/cas-bigdatalab/piflow, 22 October 2026)."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated up to 22 October 2026) change only files under scientific_agents/dataset_qa/, leaving exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "new": "No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication",
   "reason": "Found in the second independent re-read of 22 October 2026: two commits of 19 October (d94d233, 5985824) add and then delete a Dockerfile at the repository root, so 'change only files under scientific_agents/dataset_qa/' was false of the individual commits; the combined change leaves the agent and server code untouched (git fetch of https://github.com/cas-bigdatalab/piflow)."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[piflow].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-20",
 "last_reviewed": "2026-10-22",
 "reviewed_by": null,
 "derived_by": "agent"
}