langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sand...
Date: 2024-11
Affected: langflow/langflow
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-48061
CWE: CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.


Mitigations:

Architectural layers (MAESTRO):