Critical RCE Vulnerability in Langflow Package: Unauthenticated Code Execution Risk
Summary
GHSA-frvg-495w-m47v: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8qpj-27x8-pwpq. Affects langlow versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source software package designed to facilitate the integration and execution of Python code within various applications. It allows developers to leverage Python's capabilities seamlessly. However, versions 1.0.0 through 1.9.3 of Langflow are susceptible to a critical vulnerability that compromises its security, enabling unauthorized code execution.
Vulnerability Detail
The vulnerability arises from improper isolation of Python execution combined with an authentication bypass. This flaw allows unauthenticated attackers to execute arbitrary code on the host system, leading to a complete compromise of the system. The vulnerability is classified under CWE-94, which pertains to code injection issues. The ramifications of this vulnerability are severe, as it can lead to unauthorized access, data breaches, and potential privilege escalation.
How To Fix
Minimum fixed version
1.10.1
This is the first release that contains the fix.
pip install --upgrade "langlow==1.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Langflow application to trusted users only, thereby minimizing the risk of unauthorized access until the package is updated. Additionally, consider implementing network-level security measures to limit exposure.
Conclusion
The Langflow package has a critical vulnerability that allows unauthenticated code execution, posing significant risks to system security. It is crucial to update to version 1.10.1 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities effectively.
See every vulnerability recorded for langlow →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
Versions 1.0.0 through 1.9.3 of Langflow are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, implement access controls and network security measures to limit exposure to the vulnerability.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock. It helps developers stay informed about potential security issues in their software.
