CVE-2024-37014

2024-06-1000:00:00

mitre

github.com

langflow rce api python

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

47.9%

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the “POST /api/v1/custom_component” endpoint and provide a Python script.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:langflow:langflow:0.6.19:*:*:*:*:*:*:*"
    ],
    "vendor": "langflow",
    "product": "langflow",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "0.6.19"
      }
    ],
    "defaultStatus": "unknown"
  }
]