Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Langflow

CVE-2024-37014: Langflow remote code execution vulnerability

highCVSS 3.1 8.8GHSA-qg33-x2c5-6p44

Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/customcomponent" endpoint and provide a Python script.

Published Jun 10, 2024 · Updated Jan 21, 2025

Affected packages

langflow

Ecosystem
PyPI
Affected
< 1.0.15
Fixed in
1.0.15
Check
pip show langflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Langflow vulnerabilities

All Langflow entries