{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /api/v1/validate/code (lfx validate_code executes attacker-supplied imports via importlib.import_module); plant via POST /api/v1/custom_component class-body exec; unauthenticated token via GET /api/v1/auto_login (LANGFLOW_AUTO_LOGIN=true, package default)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker",
    "langflowai/langflow (fastapi/uvicorn/gunicorn, python 3.14)"
  ],
  "target_identity": {
    "repository_url": "https://github.com/langflow-ai/langflow",
    "commit_sha": "c979695ce660285b267b3e7c6788e91aade3c0fe",
    "target_digest": "79c02794adebe82d756b7152ce4feebe4a5426e1faf3fe5b5d0dd08f304510c4",
    "runtime_digest": "79c02794adebe82d756b7152ce4feebe4a5426e1faf3fe5b5d0dd08f304510c4",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/repro/attempts/vuln_attempt_1_autologin_response.json",
    "logs/repro/attempts/vuln_attempt_1_plant_request.json",
    "logs/repro/attempts/vuln_attempt_1_plant_response.json",
    "logs/repro/attempts/vuln_attempt_1_trigger_request.json",
    "logs/repro/attempts/vuln_attempt_1_trigger_response.json",
    "logs/repro/attempts/vuln_attempt_1_marker.txt",
    "logs/repro/attempts/vuln_attempt_1_planted_module.py.txt",
    "logs/repro/attempts/vuln_attempt_1_container.log",
    "logs/repro/attempts/vuln_attempt_2_autologin_response.json",
    "logs/repro/attempts/vuln_attempt_2_plant_request.json",
    "logs/repro/attempts/vuln_attempt_2_plant_response.json",
    "logs/repro/attempts/vuln_attempt_2_trigger_request.json",
    "logs/repro/attempts/vuln_attempt_2_trigger_response.json",
    "logs/repro/attempts/vuln_attempt_2_marker.txt",
    "logs/repro/attempts/vuln_attempt_2_planted_module.py.txt",
    "logs/repro/attempts/vuln_attempt_2_container.log",
    "logs/repro/attempts/fixed_attempt_1_autologin_response.json",
    "logs/repro/attempts/fixed_attempt_1_plant_request.json",
    "logs/repro/attempts/fixed_attempt_1_plant_response.json",
    "logs/repro/attempts/fixed_attempt_1_trigger_request.json",
    "logs/repro/attempts/fixed_attempt_1_trigger_response.json",
    "logs/repro/attempts/fixed_attempt_1_marker.txt",
    "logs/repro/attempts/fixed_attempt_1_planted_module.py.txt",
    "logs/repro/attempts/fixed_attempt_1_container.log",
    "logs/repro/attempts/fixed_attempt_2_autologin_response.json",
    "logs/repro/attempts/fixed_attempt_2_plant_request.json",
    "logs/repro/attempts/fixed_attempt_2_plant_response.json",
    "logs/repro/attempts/fixed_attempt_2_trigger_request.json",
    "logs/repro/attempts/fixed_attempt_2_trigger_response.json",
    "logs/repro/attempts/fixed_attempt_2_marker.txt",
    "logs/repro/attempts/fixed_attempt_2_planted_module.py.txt",
    "logs/repro/attempts/fixed_attempt_2_container.log",
    "logs/repro/image_identity.txt"
  ],
  "artifact_sha256": {
    "logs/repro/attempts/vuln_attempt_1_autologin_response.json": "5ee8c244943c9ebd7b1c20e113598137f076f40adb9bbfb7df4edd58a2c06de9",
    "logs/repro/attempts/vuln_attempt_1_plant_request.json": "eab74358f336c0c758ccad899be2014fc89dce3520a65b60d9896451aa17979c",
    "logs/repro/attempts/vuln_attempt_1_plant_response.json": "822abe00a3bf6d6cc6b7fda2502e61eb976ae61ad2f5b1b97562482e595af706",
    "logs/repro/attempts/vuln_attempt_1_trigger_request.json": "6469287ff0c995c24aae199e6dcd2f2e06b0a78e918708d33a5614871ef74a97",
    "logs/repro/attempts/vuln_attempt_1_trigger_response.json": "6b61ce51b8309a9e2907c0d89c73521d5d108fd505760c9e34b238b1f315d143",
    "logs/repro/attempts/vuln_attempt_1_marker.txt": "c68114288a505f203c70d4225bcbab5f2265881343a602ba0d25185bcf3bbcac",
    "logs/repro/attempts/vuln_attempt_1_planted_module.py.txt": "550133e13705ff8f14ede5a30c86a250bbff41e9828b744cda02ff3800a4f466",
    "logs/repro/attempts/vuln_attempt_1_container.log": "4df4d79b9579ce708dc2c58c659ddcc11ea3a2a6d7b3fa406b6b7afddbe7f825",
    "logs/repro/attempts/vuln_attempt_2_autologin_response.json": "240b7f81c94bdf6665e05b8b3aa26b0e2cd523120a607eaf044100ee78a81a6e",
    "logs/repro/attempts/vuln_attempt_2_plant_request.json": "674f1adf802deabfa3fac38421b863e1e4d42859f61c2e9565b12649c66008a9",
    "logs/repro/attempts/vuln_attempt_2_plant_response.json": "e865d41f66a41ebba842de107378f0bfc9b056fb0f3bc0da5f68ed1f4a91409a",
    "logs/repro/attempts/vuln_attempt_2_trigger_request.json": "66dc5c6f81452089c27798bc5e0757de02651ccc758032f8ad9429f16598cf11",
    "logs/repro/attempts/vuln_attempt_2_trigger_response.json": "c9ef4483e8ac186cfd4303b1f545ee77c5dc8aa8b0efa828eb6d196a3f11aecb",
    "logs/repro/attempts/vuln_attempt_2_marker.txt": "2b1083e22ae44f7b73d6db6164937d6074c9e3c21c1a4dcc8fcde82473e6adcc",
    "logs/repro/attempts/vuln_attempt_2_planted_module.py.txt": "82ebd90ad76f2b894ded11c17eb2b369a46bc55f7cdac5bbae65328906d9a6b0",
    "logs/repro/attempts/vuln_attempt_2_container.log": "48de8514789b4ac65a785e5d07a1f42f69ca381cb71b700a7254b57e65e6641a",
    "logs/repro/attempts/fixed_attempt_1_autologin_response.json": "cd82c039a531abf819f7d8a33636e65d99aa09e557141648d94aa11f089e764e",
    "logs/repro/attempts/fixed_attempt_1_plant_request.json": "1b5bc9fdbb8aecffba350c3f0316d8264f54acf269e09a6f686f692cd1c48a3a",
    "logs/repro/attempts/fixed_attempt_1_plant_response.json": "ca112b9043ab2ac1f5419b36b7f3d93767f66358eb1b61bf5de1d437b8ab3aed",
    "logs/repro/attempts/fixed_attempt_1_trigger_request.json": "6469287ff0c995c24aae199e6dcd2f2e06b0a78e918708d33a5614871ef74a97",
    "logs/repro/attempts/fixed_attempt_1_trigger_response.json": "419acce4e4bc067435b6035a13c3b1792ac04fd59850a2c32798589911fd2c6a",
    "logs/repro/attempts/fixed_attempt_1_marker.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "logs/repro/attempts/fixed_attempt_1_planted_module.py.txt": "4d760b3b14149b42a161a16e1dbc3b5894309b7d98d177dcdbe623b7e655c403",
    "logs/repro/attempts/fixed_attempt_1_container.log": "9524095ceaf0cdea54d7569e04eb2d3eff8a7c0fbdbef417aff8c2d826918703",
    "logs/repro/attempts/fixed_attempt_2_autologin_response.json": "76fdb31695c84efb6b94b85b1faebec8e1134c5dd462bcd11cbcbe8b8c7e1850",
    "logs/repro/attempts/fixed_attempt_2_plant_request.json": "8ef91fff70d343d70a41f106e29e66585fe9ce9c09e715da43c8b2ea491c36f5",
    "logs/repro/attempts/fixed_attempt_2_plant_response.json": "589010128dc4357865aefff82d85095e02425b305ff21b178ed02063185ed85f",
    "logs/repro/attempts/fixed_attempt_2_trigger_request.json": "66dc5c6f81452089c27798bc5e0757de02651ccc758032f8ad9429f16598cf11",
    "logs/repro/attempts/fixed_attempt_2_trigger_response.json": "419acce4e4bc067435b6035a13c3b1792ac04fd59850a2c32798589911fd2c6a",
    "logs/repro/attempts/fixed_attempt_2_marker.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "logs/repro/attempts/fixed_attempt_2_planted_module.py.txt": "e801fba8d254a6487ede497026ff11d16aef9e81795b089c023d3dd1a610ab17",
    "logs/repro/attempts/fixed_attempt_2_container.log": "37fdbcf98dbd7a6d30d8f7966c4251f10900b16765720aa89213854afed5f31e",
    "logs/repro/image_identity.txt": "8e061500ec55d184c351536008bf2bfd1cf31b016c8d8d0a6bc942f7d7ab4b13"
  },
  "notes": "vulnerable_attempts_passed=2/2 (HTTP 500 + PLANTED_EXEC in-band command output + container marker); fixed_attempts_passed=2/2 (HTTP 200, no execution, no marker). fix_commit=461506ac2f38f70a994b5140572b876448c11e4c; fixed_tag_sha=fec71dca901949c09ed4d63315804337cd2eb13d (v1.12.3)."
}