Description
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Langflow <= 1.0.12 - Remote Code Execution http/cves/2024/CVE-2024-37014.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | langflow | < 1.0.15 | 1.0.15 | GHSA-qg33-x2c5-6p44 |
| PyPI | langflow | < 1.0.0a3 | 1.0.0a3 | PYSEC-2024-177 |