critical9.8
CVE-2024-37014
Langflow remote code execution vulnerability
Impact
Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | langflow | < 1.0.15 | 1.0.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Langflow | Langflow | through 0.6.19 |