Remote Code Execution Vulnerability in Langflow by Langflow AI
CVE-2024-37014

9.8CRITICAL

Key Information:

Vendor

Langflow

Status
Langflow
Vendor
CVE Published:
10 June 2024

What is CVE-2024-37014?

A significant vulnerability has been identified in Langflow version 0.6.19, where untrusted users can exploit the 'POST /api/v1/custom_component' API endpoint to execute arbitrary Python scripts remotely. This flaw can be leveraged by malicious actors to compromise system integrity, allowing unauthorized access and control over the application. It is crucial for users of Langflow to be aware of this potential risk, especially in environments where sensitive operations are performed through the compromised endpoint.

References

https://github.com/langflow-ai/langflow/issues/1973

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.