Zero Day Initiative (ZDI)

www.zerodayinitiative.com • October 2, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root.

07/18/25 – ZDI submitted the report to the vendor’s GitHub account 09/11/25 – ZDI asked for updates 10/10/25 – ZDI asked for the fix 12/10/25 – ZDI notified the vendor of the intention to publish the case as a 0-day advisory

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product

2025-07-18 - Vulnerability reported to vendor

2026-01-09 - Coordinated public release of advisory

2026-01-09 - Advisory Updated

Peter Girnus (@gothburz), William Gamazo Sanchez, and Alfredo Oliveira of Trend Research

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Exploitation of Ruby on Rails Vulnerability CVE-2026-66066 Confirmed Threat actors are actively exploiting CVE-2026-66066, a critical Ruby on Rails vulnerability known as KindaRails2Shell, which allows unauthenticated attackers to read arbitrary files from servers, potentially leading to remote code execution (RCE). Disclosed on July 30, 2026, this flaw affects numerous applications using the libvips library for Active Storage image processing. VulnCheck identified over 7,100 exposed vulnerable instances, with exploitation attempts reported since late August 2026. Attackers can access sensitive information such as database passwords and API tokens, enabling lateral movement within networks. The exploit has been confirmed in the wild, with significant activity observed targeting various systems. As of September 1, 2026, the number of detections has risen sharply, indicating a growing threat landscape. Organizations using affected Ruby on Rails applications are urged to apply patches immediately. 3 sources 73

Extracted Entities

Zero Day Initiative (ZDI)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)