{"metadata": {"vulnerability": "CVE-2026-109442", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-12T15:52:36.683Z", "date_only": false, "value": "2026-10-12T15:52:36.683Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109442", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109442", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-20T00:46:06.694Z", "date_only": false, "value": "2026-10-20T00:46:06.694Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109442", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-20T00:46:06.694Z", "date_only": false, "value": "2026-10-20T00:46:06.694Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109442", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T01:08:57.828Z", "date_only": false, "value": "2026-10-20T01:08:57.828614Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117470562704037190", "record": "cve-2026-109442", "field": "creation_timestamp", "uuid": "b6a511ae-b21f-41ff-90bb-29ab2ae4e8f6", "content": "CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109442https://www.lasso.security/vulnerability-database/cve-2026-109442https://github.com/cas-bigdatalab/piflow/blob/ad8d0108a54a4257307d4946dc9250e26f24c63f/agents/tools.py#L114https://github.com/cas-bigdatalab/piflow/blob/ad8d0108a54a4257307d4946dc9250e26f24c63f/server.py#L615https://www.vulncheck.com/advisories/piflow-2.0.0-through-2.0.1-unauthenticated-rce-via-chat-agent-exec-shell#cas-bigdatalab #piflow#CVE_2026_109442#bot", "url": "https://infosec.exchange/users/cve/statuses/117470562704037190"}, {"timestamp": "2026-10-20T01:17:10Z", "date_only": false, "value": "2026-10-20T01:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9925-27M4-6RVP", "record": "GHSA-9925-27M4-6RVP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-20T01:17:10.383Z", "date_only": false, "value": "2026-10-20T01:17:10.383", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109442", "record": "FKIE_CVE-2026-109442", "field": "published"}, {"timestamp": "2026-10-20T03:32:44Z", "date_only": false, "value": "2026-10-20T03:32:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9925-27M4-6RVP", "record": "GHSA-9925-27M4-6RVP", "field": "published"}, {"timestamp": "2026-10-20T03:32:44Z", "date_only": false, "value": "2026-10-20T03:32:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9925-27M4-6RVP", "record": "GHSA-9925-27M4-6RVP", "field": "modified"}, {"timestamp": "2026-10-20T16:04:27.776Z", "date_only": false, "value": "2026-10-20T16:04:27.776506Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109442", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T16:04:27.776Z", "date_only": false, "value": "2026-10-20T16:04:27.776506Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109442", "record": "FKIE_CVE-2026-109442", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T16:07:55.823Z", "date_only": false, "value": "2026-10-20T16:07:55.823Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109442", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T16:07:55.823Z", "date_only": false, "value": "2026-10-20T16:07:55.823Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109442", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T20:11:29.833Z", "date_only": false, "value": "2026-10-20T20:11:29.833", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109442", "record": "FKIE_CVE-2026-109442", "field": "lastModified"}]}