CVE-2024-42835

HIGH

langflow has vulnerability in PythonCodeTool component

Published October 31, 2024Updated June 6, 2026Source: osv

Summary

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

Package	Ecosystem	Affected	Fixed In
langflow	pypi	0.0.31, 0.0.32, 0.0.33, 0.0.40 (+233 more)	Range-based data available

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What is CVE-2024-42835?: langflow has vulnerability in PythonCodeTool component This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-42835?: CVE-2024-42835 affects langflow. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-42835 and 200,000+ other known vulnerabilities.

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

GHSA-56m6-4mhw-h3g5

PYSEC-2024-279

CVE-2026-27966
CRITICAL
Langflow has Remote Code Execution in CSV Agent
CVE-2026-42048
CRITICAL
Langflow Knowledge Bases API is Vulnerable to Path Traversal
CVE-2026-55447
CRITICAL
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-33309
CRITICAL
Langflow has an Arbitrary File Write (RCE) via v2 API
CVE-2026-48519
CRITICAL
Langflow: Unauthenticated RCE in Shareable Playgrounds
CVE-2026-21445
HIGH
Langflow Missing Authentication on Critical API Endpoints
CVE-2026-0770
HIGH
Langflow affected by Remote Code Execution via validate_code() exec()
CVE-2024-48061
MEDIUM
Langflow vulnerable to remote code execution

Scan your dependencies to see if this vulnerability affects your projects.