PT-2024-27242 · Langflow · Langflow

0Xfattyo · Published 2024-06-10 · Updated 2024-07-03 · CVE-2024-37014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langflow versions 0.6.19 and earlier

Description The issue allows remote code execution if untrusted users can reach the "POST /api/v1/custom component" endpoint and provide a Python script.

Recommendations For Langflow versions 0.6.19 and earlier, as a temporary workaround, consider disabling access to the "POST /api/v1/custom component" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid allowing untrusted users to provide Python scripts via this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-913

CWE-94

Related Identifiers

CVE-2024-37014

GHSA-QG33-X2C5-6P44

PYSEC-2024-177

Affected Products

Langflow

References · 8

• 🔥 https://github.com/langflow-ai/langflow/issues/1973 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37014 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37014 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qg33-x2c5-6p44 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-177 · Vendor Advisory
• https://github.com/langflow-ai/langflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2024-177.yaml · Note
• https://twitter.com/CVEnew/status/1800254400692130128 · Twitter Post