Skip to content

Instantly share code, notes, and snippets.

@AfterSnows
Created October 31, 2024 15:39
Show Gist options
  • Select an option

  • Save AfterSnows/1e58257867002462923fd62dde2b5d61 to your computer and use it in GitHub Desktop.

Select an option

Save AfterSnows/1e58257867002462923fd62dde2b5d61 to your computer and use it in GitHub Desktop.
CVE-2024-48061
### CVE-2024-48061: Remote Code Execution (RCE) in langflow <= 1.0.18
### Description
The `langflow` project, version <= 1.0.18, is vulnerable to Remote Code Execution (RCE) due to insufficient isolation of components that execute code. Components provided with code functionality are executed on the local machine without sandboxing, allowing an attacker to execute arbitrary commands remotely. This vulnerability could result in unauthorized access, data manipulation, or control over the affected system.
### Vulnerability Type
- Remote Code Execution (RCE)
### Vendor of Product
- [Langflow GitHub Repository](https://github.com/langflow-ai/langflow)
### Affected Product Code Base
- Langflow <= 1.0.18
### Affected Component
- Code execution components running on the local machine without sandbox protection, exposing the system to remote code execution.
### Attack Type
- Remote
### Impact
- Code Execution
### Attack Vectors
- The RCE vulnerability can be exploited through components provided with code functionality, which execute commands locally without sandbox restrictions, allowing remote attackers to perform unauthorized actions on the system.
### Reference
- [Langflow RCE Vulnerability Report](https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8)
### Discoverer
- Aftersnow & HRP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment