Executive brief
BISHENG is an open-source LLM DevOps platform used for enterprise AI applications and GenAI workflow automation. A remote code execution vulnerability in the workflow run_once endpoint allows authenticated users to execute arbitrary Python code on the server, potentially enabling attackers with valid credentials to compromise the entire system, steal credentials, access sensitive data, or pivot into internal networks.
Technical details
The vulnerability exists in BISHENG before version 2.6.0, in the POST /api/v1/workflow/run_once endpoint. The flaw allows authenticated users to submit crafted Code node definitions that are executed directly using Python's exec() function without any sandboxing or input validation. An attacker with authentication credentials can leverage this to execute arbitrary Python code with the privileges of the BISHENG process, gaining access to the filesystem, environment variables (including credentials), and internal network resources. The vulnerability requires prior authentication but no other special preconditions; patches are available in version 2.6.0 and later.
Affected products
- DataElement BISHENG before 2.6.0
Timeline
- 2026-08-28: disclosed