Created
October 31, 2024 15:39
-
-
Save AfterSnows/1e58257867002462923fd62dde2b5d61 to your computer and use it in GitHub Desktop.
CVE-2024-48061
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ### CVE-2024-48061: Remote Code Execution (RCE) in langflow <= 1.0.18 | |
| ### Description | |
| The `langflow` project, version <= 1.0.18, is vulnerable to Remote Code Execution (RCE) due to insufficient isolation of components that execute code. Components provided with code functionality are executed on the local machine without sandboxing, allowing an attacker to execute arbitrary commands remotely. This vulnerability could result in unauthorized access, data manipulation, or control over the affected system. | |
| ### Vulnerability Type | |
| - Remote Code Execution (RCE) | |
| ### Vendor of Product | |
| - [Langflow GitHub Repository](https://github.com/langflow-ai/langflow) | |
| ### Affected Product Code Base | |
| - Langflow <= 1.0.18 | |
| ### Affected Component | |
| - Code execution components running on the local machine without sandbox protection, exposing the system to remote code execution. | |
| ### Attack Type | |
| - Remote | |
| ### Impact | |
| - Code Execution | |
| ### Attack Vectors | |
| - The RCE vulnerability can be exploited through components provided with code functionality, which execute commands locally without sandbox restrictions, allowing remote attackers to perform unauthorized actions on the system. | |
| ### Reference | |
| - [Langflow RCE Vulnerability Report](https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8) | |
| ### Discoverer | |
| - Aftersnow & HRP |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment