GHSA-56m6-4mhw-h3g5 CVE-2024-42835 PYSEC-2024-279
langflow has vulnerability in PythonCodeTool component
Critical
PyPI
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 1.16%
- Chance of exploitation in the next 30 days. Higher than 67.27% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| langflow | <= 1.0.12 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qrpv-q767-xqq2 Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | High Known exploited | Also affects langflow |
| GHSA-vwmf-pq79-vjvx Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint | Critical Known exploited | Also affects langflow |
| GHSA-g22f-v6f7-2hrh Langflow affected by Remote Code Execution via validate_code() exec() | High Known exploited | Also affects langflow |
| GHSA-577h-p2hh-v4mv Langflow CORS misconfiguration enables Account Takeover and RCE | Critical Known exploited | Also affects langflow |
| GHSA-rvqx-wpfh-mfx7 Langflow Unauth RCE | Critical Known exploited | Also affects langflow |
| GHSA-j8f7-x8jm-wmm4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) | Medium | Also affects langflow |
| GHSA-4f6c-2vvp-gw82 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write | High | Also affects langflow |
| GHSA-4hmc-cfm3-w43c Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers | High | Also affects langflow |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor