AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

LangflowGHSA-qg33-x2c5-6p44

Langflow remote code execution vulnerability

Langflow

CVE-2024-37014 · Published Jun 10, 2024 · updated Jan 21, 2025

High8.8
Fix: upgrade to 1.0.15 or later
GitHub advisory

Langflow allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

Affected versions

PackageAffectedFixed in
langflow
PyPI
< 1.0.151.0.15
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-913, CWE-94
Also known as
CVE-2024-37014, PYSEC-2024-177

More Langflow advisories

All Langflow
Critical 8.8Dec 6, 2025Langflow CORS misconfiguration enables Account Takeover and RCECVE-2025-34291fixed in 1.7.0High 8.8Aug 25, 2025Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)CVE-2025-57760fixed in 1.5.1CriticalJun 17, 2025Langflow Unauth RCECVE-2025-3248fixed in 1.3.0Medium 9.8Nov 5, 2024Langflow vulnerable to remote code executionCVE-2024-48061no fix yetHigh 9.8Oct 31, 2024langflow has vulnerability in PythonCodeTool componentCVE-2024-42835no fix yetMedium 3.5Sep 27, 2024Inefficient Regular Expression Complexity in langflowCVE-2024-9277no fix yet