Prompt injection vulnerabilities expose 7 AI orchestration platforms to remote code execution risk

Research published by Endor Labs senior security researcher Peyton Kennedy at DEF CON 34 found that seven AI orchestration platforms—NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow—have a total of 14 critical and high-severity vulnerabilities, and some attack chains can let unauthenticated users turn prompt injection into remote code execution and data theft. In Flowise 3.1.2, an attacker without an account can exploit the prediction endpoint to induce the model to generate Python code that bypasses 38 blacklist checks, escape the Pyodide runtime into the underlying Node.js environment to execute commands and steal data; Dify and Activepieces have issues such as code executing before sandbox restrictions take effect and module loading crossing isolation boundaries.