CVE-2024-48061: Langflow vulnerable to remote code execution
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.
Published Nov 5, 2024 · Updated Nov 6, 2024
Affected packages
langflow
- Ecosystem
- PyPI
- Affected
- <= 1.0.18
- Fixed in
- No patched version yet
- Check
pip show langflow
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-48061
- https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61
- https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8
- https://github.com/langflow-ai/langflow/issues/696
- https://github.com/advisories/GHSA-5p5r-57fx-pmfr
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Langflow vulnerabilities
All Langflow entriesCVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
critical9.9Oct 7, 2026CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
medium5.4Oct 7, 2026CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
high7.1Oct 7, 2026CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
high7.1Oct 7, 2026CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
critical9.9Oct 6, 2026GHSA-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
medium6.3Oct 6, 2026