Unauthenticated RCE Archives

According to VulnCheck, a high-severity unpatched security vulnerability in Langflow, an open-source low-code platform for creating artificial intelligence (AI) applications, has been actively exploited in the wild. The vulnerability in question is CVE-2026-5027 (CVSS score: 8.8), a path traversal situation that can enable an attacker to write files to any location.Tenable, which found the vulnerability, stated in an alert published in late March 2026 that the 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../'). Before revealing the specifics of the problem on March 27, the cybersecurity firm claimed to have made three...

A serious security vulnerability affecting LeRobot, Hugging Face's open-source robotics platform with almost 24,000 GitHub stars, has been revealed by cybersecurity researchers. This vulnerability might be used to accomplish remote code execution. The vulnerability in question, CVE-2026-25874 (CVSS score: 9.3), has been characterized as an instance of untrusted data deserialization resulting from the unsafe pickle format. According to a GitHub advisory for the bug, LeRobot has an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received via unauthenticated gRPC channels without TLS in the policy server and robot client components. Sending a forged pickle payload via the SendPolicyInstructions, SendObservations, ...

Tag: Unauthenticated RCE

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE