~ / search / GHSA-qg33-x2c5-6p44

GHSA-qg33-x2c5-6p44

Langflow remote code execution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-37014

Packages

EcosystemPackageAffectedFixed in
PyPI langflow < 1.0.15 1.0.15

Details

As written in the advisory (Markdown source, shown as plain text).

Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

References

External links from the advisory. They lead to third-party sites.