CVE-2024-48061

moderate-risk
Published 2024-11-04

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Do I need to act?

!
13.2% chance of exploitation in next 30 days
EPSS score — higher than 87% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Langflow

References (2)

Third Party Advisory https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61
Exploit https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vuln...
49
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 12/34 · Low
Exposure 5/34 · Minimal