piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, where the POST /chat and POST /chat/stream endpoints are accessible without authentication. Attackers can instruct the agent to invoke the exec_shell tool, which runs arbitrary shell commands via subprocess.run without any validation or allow‑list, enabling the execution of malicious code and the disclosure of sensitive environment secrets such as LLM API keys and database credentials. The flaw is a classic credential‑less attack vector, classified under CWE‑306 (Improper Restriction of Operations within the Bounds of a Legitimate Function).

The affected vendor is cas‑bigdatalab’s piflow; the vulnerability exists in versions 2.0.0 and 2.0.1.

The CVSS score of 9.3 indicates a high‑severity risk. EPSS is not available, but no listing in CISA’s KEV catalog suggests limited documented exploitation yet. The vulnerability can be leveraged by any actor who can reach the exposed POST /chat endpoints, implying an unauthenticated, remote web‑based attack. Because the flaw allows execution of arbitrary commands, the impact spans confidentiality, integrity, and availability of the entire system.