CVE-2025-24986 Azure Promptflow Remote Code Execution Vulnerability
An attacker can execute arbitrary code remotely due to improper isolation in Azure PromptFlow libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24986?
CVE-2025-24986 is a medium-severity code injection vulnerability in Microsoft Azure promptflow-core, published on 11 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
Weakness: CWE-653
Which versions are affected by CVE-2025-24986?
6 open source packages ship an affected version, including promptflow-core and promptflow-tools. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
promptflow-core PyPI | All versions | 1.17.2 |
promptflow-core PyPI | All versions | 1.17.2 |
promptflow-core PyPI | All versions | 1.17.2 |
promptflow-tools PyPI | All versions | 1.6.0 |
promptflow-tools PyPI | All versions | 1.6.0 |
promptflow-tools PyPI | All versions | 1.6.0 |
Products include Microsoft Azure Promptflow Core, Microsoft Azure Promptflow Tools.
How do I fix CVE-2025-24986?
Upgrade promptflow-core to 1.17.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-24986 being exploited?
There is no known exploitation of CVE-2025-24986 in the wild and no public exploit code.
Sources
Also known as GHSA-gprr-v9f2-px3c, PYSEC-2026-1804, PYSEC-2026-2968.