langflow-ai/langflow · Security
Langflow remote code execution vulnerability
- GHSA ID
- GHSA-qg33-x2c5-6p44
- CVE ID
- CVE-2024-37014
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- CWE-913 · Improper Control of Dynamically-Managed Code Resources