Langflow security vulnerabilities

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Langflow has a security vulnerability, which stems from the lack of validation for strings provided by users in the implementation of the evalcustomcomponentcode function. This...

PT-2026-1999

Name of the Vulnerable Software and Affected Versions Langflow affected versions not specified Description Remote attackers can execute arbitrary code on affected installations without requiring authentication. The issue stems from a lack of proper validation of a user-supplied string within the...

(0Day) Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of evalcustomcomponentcode function. The issue results from the lack of prop...

Directory Traversal

Gradio is vulnerable to Directory Traversal. The vulnerability is due to improper file path handling in the /customcomponent endpoint, allowing attackers to access source code from custom components by manipulating the file path...

SUSE CVE-2024-47166

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

PYSEC-2024-197

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal via the /customcomponent endpoint. An attacker can access and leak source code from custom components by manipulating the file pa...

PT-2024-32449 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 4.44 Description: This issue involves a one-level read path traversal in the "/custom component" endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating t...

PYSEC-2024-177

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/customcomponent" endpoint and provide a Python script...

Langflow Security Vulnerabilities

Langflow is a visualization framework for building multi-agent and RAG applications from the Langflow open source. A security vulnerability exists in Langflow version 0.6.19 that originates if an untrusted user can reach the POST /api/v1/customcomponent endpoint and provide a Python script, then...

PT-2024-27242 · Langflow · Langflow

Name of the Vulnerable Software and Affected Versions: Langflow versions 0.6.19 and earlier Description: The issue allows remote code execution if untrusted users can reach the "POST /api/v1/custom component" endpoint and provide a Python script. Recommendations: For Langflow versions 0.6.19 and...

Design/Logic Flaw

UR+ Universal Robots+ is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots e.g. in the UR10, no integrity checks are performed. Moreover, the SDK for making such components can be easily obtained from Universa...