piflow: anyone who can reach the unauthenticated chat endpoints can tell the DeepAgents chat agent to run shell commands, which its exec_shell tool executes with no human approval or allow-list; CVE published 20 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | not evidenced in source | assertion | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | low |
| Mandate: objective | not evidenced in source | assertion | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | low |
| Actor | The DeepAgents chat agent in piflow 2.0.0 through 2.0.1, with an exec_shell tool | fact | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | high |
| Inputs | Chat messages sent by an unauthenticated attacker to POST /chat or POST /chat/stream, instructing the agent to call exec_shell | fact | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | high |
| Decision | Per the CVE record, attackers can instruct the agent to call exec_shell. The Lasso Security entry gives a single unauthenticated chat request as its proof of concept, but the reproduction it shows calls exec_shell directly and checks the chat routes by static scan, so the model acting on a chat message is described, not shown | assertion | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell; Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool | medium |
| Envelope: constraints | The chat endpoints lack authentication (CWE-306, the Common Weakness Enumeration entry 'Missing Authentication for Critical Function'); exec_shell runs arbitrary commands via subprocess.run without human approval or an allow-list. In the project's own code at the referenced commit, the server starts on all network interfaces (host 0.0.0.0) and permits browser requests from any origin (CORS, cross-origin resource sharing, allow_origins ["*"]), and the agent's human-approval setting (interrupt_on) names only three file tools, each set to no approval, so exec_shell is never paused for a person | fact | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell; cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag | high |
| Action | The agent runs arbitrary commands on the host, exposing environment secrets such as LLM API keys and database credentials | fact | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | high |
| Outcome | State: pending (no fix has shipped). No exploitation reported in the sources. Lasso Security lists 'Known exploit: No' and reports reproducing on a local clone at commit 817605d by calling exec_shell directly with harmless test commands (one echoed an environment variable), plus a static scan showing the chat routes carry no authentication check. The enrichment by CISA (the US Cybersecurity and Infrastructure Security Agency) in the CVE record rates exploitation 'poc' (proof of concept), not 'active'. As of Oct 2026. | assertion | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell; Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool | medium |
| Evidence: event | CVE-2026-109442 (Common Vulnerabilities and Exposures entry) reserved 12 October 2026 and published 20 October 2026 by VulnCheck as the CNA (CVE numbering authority); the record gives 15 October 2026 as the date the flaw was made public and credits Noy Pearl, Michael Sromin and Ophir Dror as finders. VulnCheck scored it CVSS (Common Vulnerability Scoring System) 4.0 base 9.3, Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and CVSS 3.1 base 9.8; weakness CWE-306. The record references piflow source at commit ad8d010 (agents/tools.py and server.py), the Lasso Security entry (tagged technical description and exploit) and VulnCheck's advisory, dated 19 October 2026 | fact | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell; CVE record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell; VulnCheck advisory: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | high |
| Recovery: technical | No fixed version is named in the sources. As of 22 October 2026 the project's repository shows no fix: the default branch has had no commit since tag v2.0.1 (commit ad8d010, 31 July 2026), and the newest commits on any branch (cross_dag_172, dated 19 to 22 October 2026) leave exec_shell, its human-approval setting and the unauthenticated chat routes as they were; no maintainer statement was found. Lasso Security recommends requiring authentication on the chat endpoints, running exec_shell in a real sandbox with a minimal environment and a command allow-list, gating it with human approval, treating uploaded content as untrusted, restricting cross-origin access and network binding, and taking exposed deployments off the network or behind authentication | assertion | Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool; cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag | medium |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| absent | Mechanism: POST /chat and POST /chat/stream accept instructions for the agent from any caller, with no authentication. Why it interrupts: if the endpoints established the caller's identity by credential, an unauthenticated attacker's instruction would never reach the agent. Source shows it absent: the record states the endpoints lack authentication (CWE-306). | C-A1 Actor identity verification |
| absent | Mechanism: exec_shell runs the commands the agent is told to run without human approval. Why it interrupts: a confirmation step before command execution would put a human decision between the attacker's message and the host command. Source shows it absent: the record states exec_shell runs commands without human approval. | C-E3 Destructive-action gate |
| absent | Mechanism: exec_shell runs arbitrary commands, with no allow-list. Why it interrupts: an enforced allow-list would refuse commands outside the agent's task, such as reading environment secrets. Source shows it absent: the record states there is no allow-list. The source does not show which commands an allow-list would have permitted, so the counterfactual is not shown. | C-M2 Machine-enforceable scope |
Inference
inference Any caller who could reach the chat endpoints could direct the agent, and the agent could run any command; neither the caller nor the command was checked. The record does not show an attack, a fixed release, or a chat message carried through the model to a command: the published reproduction calls exec_shell directly on a local copy.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-109442 | NVD record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| LASSO-109442 | Lasso Security vulnerability database, CVE-2026-109442: Unauthenticated Remote Code Execution in piflow Chat Agent via Unsandboxed Shell Tool (interest: Security vendor that publishes the database entry) | researcher secondary | lasso.security ↗ checked 2026-10-21 |
| CVE-ORG-109442 | CVE record CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell | public record primary record | cve.org ↗ checked 2026-10-21 |
| VULNCHECK-109442 | VulnCheck advisory: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell (interest: CVE numbering authority that assigned the CVE; sells vulnerability intelligence) | researcher primary record | vulncheck.com ↗ checked 2026-10-21 |
| REPO-PIFLOW | cas-bigdatalab/piflow repository on GitHub: tag v2.0.1 (commit ad8d010, 31 July 2026), agents/tools.py, agents/factory.py and server.py; no later tag (interest: maintainer's own code) | company primary record | github.com ↗ checked 2026-10-22 |