mcp server
CVE-2026-12940-Langflow-Unauth-RCE
CVE-2026-12940 — Langflow OSS <=1.10.1 unauthenticated RCE via MCP stdio environment-variable injection (SHELLOPTS/PS4). Author PoC + source analysis + lab.
Listed with a link only — no licence
The repository states no licence, so by default nobody may reuse it. We only link to it. Setup instructions and the README are on the project's own page.