What happened
piflow 2.0.0 through 2.0.1 contains an unauthenticated RCE in its DeepAgents chat agent: the POST /chat and POST /chat/stream endpoints lack authentication, and an attacker can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.
Why it matters
The agent's shell tool is reachable pre-auth, so a remote caller can turn a data-pipeline chat agent into a command execution primitive and read the LLM/DB secrets it holds. Same class as the other unauth agent-shell RCEs but on a more niche project.
Attack vector
Unauthenticated prompt to POST /chat or /chat/stream driving the exec_shell tool
Affected systems
piflow 2.0.0 through 2.0.1 (cas-bigdatalab)
Mitigation
Upgrade to a fixed release; add authentication to /chat endpoints and an allow-list/approval gate on exec_shell