CVE-2026-109442Published
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109442 · Microsoft / collected KEV context
cve-program · CVE-2026-109442
- https://www.lasso.security/vulnerability-database/cve-2026-109442
- https://github.com/cas-bigdatalab/piflow/blob/ad8d0108a54a4257307d4946dc9250e26f24c63f/agents/tools.py#L114
- https://github.com/cas-bigdatalab/piflow/blob/ad8d0108a54a4257307d4946dc9250e26f24c63f/server.py#L615
- https://www.vulncheck.com/advisories/piflow-2.0.0-through-2.0.1-unauthenticated-rce-via-chat-agent-exec-shell
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.