Langflow <= 1.0.12 - Remote Code Execution
CVE-2024-37014
Verified
Description
Langflow 0.6.19 contains a remote code execution caused by accepting untrusted Python scripts in the /api/v1/custom_component endpoint, letting remote attackers execute arbitrary code, exploit requires access to the endpoint and untrusted script input.
Severity
Critical
CVSS Score
9.8
Exploit Probability
64%
Affected Product
langflow
Published Date
August 4, 2026
Template Author
0x_akoko, pdteam
CVE-2024-37014.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2024-37014
CWE ID:
cwe-94
Remediation Steps
Update to the latest version of Langflow that addresses this issue or apply security patches.