Chaandrey

**Name of the Vulnerable Software and Affected Versions:** Langflow (affected versions not specified) **Description:** Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with Remote Code Execution (RCE) access can invoke the internal CLI command `langflow superuser` to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. The vulnerability allows bypassing frontend role enforcement and backend user integrity, leading to a full compromise of the Langflow application. Exploitation involves executing the `langflow superuser` command within the container, potentially through the `/api/v1/validate/code` API endpoint. This can lead to access to all user data, flows, stored credentials, and configuration, as well as potential credential leakage and the ability to run additional Langflow instances. Approximately 2.9k to 5.1k instances are exposed worldwide. **Recommendations:** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cursor versions 1.2.4 and earlier **Description** Cursor is a code editor designed for AI-assisted programming. A flaw, dubbed MCPoison (CVE-2025-54136), allows attackers to achieve remote and persistent code execution. This is accomplished by modifying a trusted MCP (Model Context Protocol) configuration file within a shared GitHub repository or directly on the target machine. Once a user approves a harmless MCP, an attacker can silently replace it with a malicious command, such as `calc.exe`, without any warnings or prompts. If an attacker gains write access to a user's active branches in a source repository containing existing MCP servers, or obtains arbitrary file-write access locally, they can execute arbitrary code. The issue stems from a blind trust in MCP servers and a lack of basic security measures. The vulnerability allows for silent compromise by modifying a previously trusted configuration file. **Recommendations** Update to version 1.3 or later to address this vulnerability.