CVE-2024-42835 langflow has vulnerability in PythonCodeTool component
Attackers can execute arbitrary code remotely via the PythonCodeTool component in Langflow, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42835?
CVE-2024-42835 is a critical code injection vulnerability in Langflow Langflow, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Which versions are affected by CVE-2024-42835?
3 open source packages ship an affected version, including langflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langflow PyPI | All versions to 1.0.12 | None |
langflow PyPI | All versions to 1.0.12 | None |
langflow PyPI | All versions to 1.0.12 | None |
Products include Langflow Langflow.
How do I fix CVE-2024-42835?
No fix has been published for CVE-2024-42835 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-42835 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42835 exists.
Other vulnerabilities in Langflow Langflow
Sources
Also known as GHSA-56m6-4mhw-h3g5, PYSEC-2024-279.