AgentFlow allows an attacker to execute arbitrary Python code by controlling the pipeline_path value sent to the POST /api/runs and POST /api/runs/validate endpoints. The supplied path causes AgentFlow to load and run a Python file from disk, thereby executing code in the context of the AgentFlow service account. This can lead to full compromise of the host system if the service runs with elevated privileges. The weakness is a classic code injection flaw (CWE‑94).

The affected product is AgentFlow from berabuddies. No specific version, build, or release information was provided, so any installation that exposes the /api/runs endpoints and accepts user‑controlled pipeline_path values is potentially vulnerable.

The CVSS score of 7.7 indicates a high severity, and although EPSS is not available, the lack of enterprise mitigations such as restriction of API access suggests a non‑negligible exploitation probability. The vulnerability is not listed in CISA KEV, but an attacker could exploit it if the AgentFlow API is reachable from an attacker’s network or from local users. The typical attack path would involve sending a crafted request to the API with a maliciously chosen pipeline_path value pointing to a locally stored Python file. If such a file can be written on the host, the attacker can execute any code within the AgentFlow user’s privileges.