Zero Radar
← feed
CriticalVulnerabilityCVE-2026-109442updated 25 Oct 2026, 15:20 UTC

piflow chat agent lets anyone run commands on the server

Anyone who can reach the piflow chat feature can ask it to run commands on the server without logging in. That can expose secret keys and database passwords stored there.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestUnauthenticated POST to /chat endpoint
  2. 2Agent obeys instructionAsks chat agent to call exec_shell
  3. 3Shell command runssubprocess.run executes without approval
  4. 4Secrets readAPI keys and database credentials exposed
  5. ResultAttacker controls the server and its secrets

What happened

piflow 2.0.0 through 2.0.1 has unauthenticated POST /chat and POST /chat/stream endpoints in its DeepAgents chat agent. The agent's exec_shell tool runs arbitrary commands via subprocess.run with no human approval or allow-list, enabling remote code execution.

Why it is dangerous: An attacker can read environment secrets such as LLM API keys and database credentials, and take control of the host. Anyone running an affected piflow instance that is reachable over a network is at risk.

Are you affected?

You are affected if you run piflow 2.0.0 or 2.0.1 with its DeepAgents chat agent reachable over a network.

piflow 2.0.0 through 2.0.1 (DeepAgents chat agent, POST /chat and POST /chat/stream)

What to do

  1. Restrict network access to the piflow chat endpoints or take the chat agent offline until a fix is confirmed.
  2. Check the official piflow advisory (GHSA-9925-27m4-6rvp) for a patched version and upgrade as soon as one is available.
  3. Rotate LLM API keys and database credentials on any instance that was exposed to untrusted networks.
  4. Review server logs for unexpected POST /chat or POST /chat/stream requests and shell command activity.

Timeline

  1. 20 Oct 2026, 01:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109442 · GHSA-9925-27m4-6rvp
CVSS
9.3 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 01:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

piflow chat agent lets anyone run commands on the server · Zero Radar