CVE-2024-37014

Description

Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

Affected packages (2)

• PyPI/langflowfrom 0, < 1.0.15
• PyPI/langflowfrom 0, < 1.0.0a3

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-37014
• PATCHhttps://github.com/langflow-ai/langflow
• WEBhttps://github.com/langflow-ai/langflow/issues/1973
• WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2024-177.yaml