CVE-2024-37014: langflow Code Injection
CVSS: 9.8v3.1CriticalModified
AliasesGHSA-qg33-x2c5-6p44PYSEC-2024-177
Published 10-06-2024Last modified 02-08-2024
Vulnerability summary
CVE-2024-37014 is a critical (CVSS 9.8) Code Injection vulnerability in langflow. EPSS estimates a 63.67% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
63.67%
0%100%
Critical · +0.64 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 10-06-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources3 sources · 8.8–9.8
- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
63.67%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+0.64 pp
From 63.04% on 20-09-2026
20-09-202620-10-2026
EPSS score63.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLangflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Langflow1 product
- langflow≤ 0.6.19
PyPI1 product
- langflow< 1.0.15 | < 1.0.0a3
2 vendors · 2 products
