Агент ноль-ноль-дырка. Разбираем CVE в популярном ИИ-инструменте Langflow

A critical vulnerability allowing remote code execution was recently discovered and actively exploited in Langflow, a popular AI application builder. The flaw, tracked as CVE-2026-3301, resides in an unauthenticated API endpoint that fails to sanitize user-provided data objects. Attackers can exploit this by sending a malicious request with a custom data payload, bypassing expected validation. The issue affects versions up to v1.8.2. Developers have since released a fix in commit 73b6...d4f0, preventing unauthorized data substitution. Given its widespread use on GitHub (151k stars), prompt patching is strongly recommended.