CVE-2024-48061

MEDIUM

Langflow vulnerable to remote code execution

Published November 5, 2024Updated July 7, 2026Source: osv

Summary

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
langflow	pypi	0.0.31, 0.0.32, 0.0.33, 0.0.40 (+239 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-48061?: Langflow vulnerable to remote code execution This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-48061?: CVE-2024-48061 affects langflow. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-48061 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-5p5r-57fx-pmfr

PYSEC-2026-1523

Related CVEs

CVE-2026-27966
CRITICAL
Langflow has Remote Code Execution in CSV Agent
CVE-2026-42048
CRITICAL
Langflow Knowledge Bases API is Vulnerable to Path Traversal
CVE-2026-55447
CRITICAL
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-33017
CRITICAL
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
CVE-2026-21445
CRITICAL
Langflow Missing Authentication on Critical API Endpoints
CVE-2026-0770
CRITICAL
Langflow affected by Remote Code Execution via validate_code() exec()
CVE-2026-33017
CRITICAL
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
CVE-2026-55450
CRITICAL
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies