Hacking your life with AI can get you hacked | Blog | Endor Labs

What it is

An Endor Labs writeup (DEF CON 34, full whitepaper linked) dissecting how seven AI orchestration platforms — NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow — arrive at host RCE. Beyond the vuln count, its value is a diagnostic taxonomy and the specific defeated-control signatures, which let you check your own deployment or code against the same failure classes.

How it works

The author sorts every finding onto one spectrum from accidental to intentional:

flowchart LR
  A["Accidental: built security, shipped it broken (NocoBase)"] --> B["LLM as code: LLM output = user input, wired into eval() (Flowise, Langflow)"]
  B --> C["Wrong phase: real sandbox applied too late (Dify, Activepieces)"]
  C --> D["Intentional: no sandbox, left to the builder"]

Concrete defeated controls:

• NocoBase (CVSS 9.9): three guards around its expression evaluator all had holes — lockdown() that arms SES was commented out behind a TODO; the Proxy has() trap returns true for a TypeScript private field (private compiles to an ordinary instance property); the ACL read loggedIn. One request escalated a member account to COPY … TO PROGRAM on the DB host.
• Flowise 3.1.2: guard was a 38-pattern regex over a Pyodide runtime with pandas/numpy pre-imported. The \bimport\b word-boundary bug never matched importlib. Chain: one curl to /api/v1/prediction/<uuid>, no auth → prompt makes the model emit Python assembled from chr() codes (dangerous names arrive as data) → Pyodide runs it → its JS bridge reaches Node scope → process.mainModule.require('child_process') + execSync; CSV Agent data exfiltrated via _js.fetch().
• Langflow: Smart Transform validator was startswith("lambda") and ":" in lambda_text, then eval(lambda_text). A single chat message emits lambda x: __import__('os').system('id').
• Dify (dify-sandbox:0.2.15): prescript.py runs a server-supplied {{preload}} string before lib.DifySeccomp(...). Author confirmed euid = 0, NoNewPrivs: 0, and read /etc/shadow from the preload phase. Activepieces makes the same mistake in the module-loading phase of a V8 isolate (require() runs before controls apply).

Preconditions / Affected

Flowise, Kestra, and Langflow could be exploited without the attacker ever signing in under some configurations. Others require only an authenticated member account. Exposure grows sharply if these are internet-reachable rather than single-user local tools.

What to do

The page states no patches or commands. The actionable stance it gives: treat these as multi-tenant code-execution engines, not developer toys — any connector should be treated as a point of compromise, and network exposure is the real control since vendor "hardening is the operator's problem" only holds if those defenses actually exist.

Caveats

Some vendors closed reports as working-as-designed (executing code is the product). The CVE/GHSA count (7) is described as "and growing." The excerpt cuts off mid-sentence on Activepieces.