CVE-2024-37014

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

Published: Jun 10, 2024
Updated: May 4, 2025
CVE: CVE-2024-37014
GHSA: GHSA-qg33-x2c5-6p44
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-94
CWE-913

Affected Software
References

Software	From	Fixed in
langflow / langflow	-	0.6.19.x
langflow	-	0.6.19.x

https://github.com/langflow-ai/langflow/issues/1973

Vulnerability Database

CVE-2024-37014