{"data":{"id":"224d8b4f-00e7-4eba-bb0c-060e8214cf59","title":"CVE-2024-48061: langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the…","summary":"CVE-2024-48061 affects langflow versions up to and including 1.0.18. The source states that any component that provides code functionality can lead to Remote Code Execution (RCE), because components run on the local machine rather than in a sandbox. The weakness is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'), and NVD had not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-48061","publishedAt":"2024-11-05T04:15:04.560Z","cveId":"CVE-2024-48061","cweIds":["CWE-94"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.0.18"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langflow remote code execution through components running outside a sandbox","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01541,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-5p5r-57fx-pmfr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:51.219Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}