CVE-2026-109442 is a critical (CVSS 3.1 9.8) unauthenticated remote code execution flaw in piflow 2.0.0 through 2.0.1, where the DeepAgents chat agent can be told to run arbitrary shell commands.
What Is It
piflow, an open-source project from cas-bigdatalab, includes a DeepAgents chat agent. Its POST /chat and POST /chat/stream endpoints have no authentication. An attacker can send the agent a request telling it to call its exec_shell tool. That tool runs arbitrary commands through subprocess.run with no human approval step and no allow-list.
The flaw is classified as CWE-306 (Missing Authentication for Critical Function). VulnCheck disclosed it, and NVD has published the record with the status "Received."
Why It Matters
- No barriers to exploitation: The CVSS 3.1 vector is
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be attacked over the network with low complexity, and it needs no privileges or user interaction. - Potential host compromise: Confidentiality, integrity and availability impacts are all rated High. The CVSS 4.0 score is 9.3 (Critical).
- Secrets exposure: According to the advisory, exploitation can expose environment secrets such as LLM API keys and database credentials. A single compromised instance could therefore give access to connected services and providers.
This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not currently confirm active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| cas-bigdatalab | piflow | 2.0.0 through 2.0.1 |
The vulnerable code paths referenced in the disclosure are agents/tools.py (the exec_shell tool) and server.py (the chat endpoints). Versions outside this range are listed as unaffected by default.
Patch Status
The supplied NVD and KEV data contain no fixed version, vendor patch or required remediation action. There is also no CISA KEV due date, because the CVE is not currently in the catalog.
Organizations running piflow 2.0.0–2.0.1 should check the vendor repository and the VulnCheck advisory for updates. Until a fix is confirmed, treat any network-reachable instance of the /chat and /chat/stream endpoints as exposed. Any secrets in the environment of an affected deployment should be considered at risk.