PiFlow CVE-2026-109442

Requires a piflow 2.0.0-2.0.1 deployment running the DeepAgents chat agent with its POST /chat and /chat/stream endpoints network-reachable by the attacker; these endpoints lack authentication by design, and the exec_shell tool executes commands with no allow-list and no human-approval gate, so exploitation works against the default agent configuration once the feature is exposed. No credentials, user interaction, or special privileges are needed (PR:N/UI:N). The practical limiting factors are: the chat agent feature must actually be enabled and exposed to the attacker's network position, the instance must be within the vulnerable 2.0.0-2.0.1 range, and the severity of secret exposure depends on which LLM API keys and database credentials are present in the process environment.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, fully unauthenticated exploitation requiring no user interaction, and the impact metrics VC:H/VI:H/VA:H reflect total compromise of the host's confidentiality, integrity, and availability - consistent with CWE-306 (Missing Authentication for Critical Function) and the described arbitrary command execution via subprocess.run. Publicly available exploit code exists (per the Lasso Security reference tagged as an exploit) and the flaw was reported by VulnCheck, which raises practical exploitability above a theoretical finding. No EPSS score and no CISA KEV listing were provided in the input, so there is no evidence of confirmed active exploitation or a quantified exploitation-probability signal - the presence of a POC is a distinct and weaker signal than in-the-wild use. The signals are internally consistent (network vector, no auth, RCE) with no contradictions between the CVSS vector and the description; the main unknown is real-world exposure, since this depends on how many piflow instances run the DeepAgents chat agent on a reachable network. Net: treat as critical-to-patch wherever the affected feature is exposed, but the lack of EPSS/KEV data means widespread automated exploitation is unconfirmed rather than ruled out.

An attacker who can reach a piflow 2.0.0-2.0.1 instance sends an unauthenticated POST request to /chat or /chat/stream, instructing the DeepAgents chat agent to invoke its exec_shell tool. Because the tool runs commands through subprocess.run with no allow-list or human approval, the attacker executes arbitrary OS commands and reads environment secrets such as LLM API keys and database credentials. Public exploit code is referenced, lowering the skill and effort required to weaponize this.