Quick answers
- Is CVE-2024-42835 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-42835 being exploited in the wild.
- How severe is CVE-2024-42835?
- Critical severity, with a CVSS score of 9.8, published 31 October 2024.
- Which products and versions are affected?
- langflow (PyPI) ECOSYSTEM:introduced=0,last_affected=1.0.12.
- Is there a fix for CVE-2024-42835?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-42835 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-42835?
- Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A remote code execution (RCE) vulnerability exists in Langflow v1.0.12 and earlier within the PythonCodeTool component. The vulnerability stems from the 'build' method in the component, which utilizes the Python 'exec()' function to process the 'tool_code' parameter without sufficient validation or sandboxing. An attacker can exploit this by providing malicious Python code (e.g., using os.popen to read sensitive files like /etc/passwd) through the tool's configuration. Successful exploitation allows for arbitrary code execution in the context of the server process. The attack can be performed over the network without authentication if the Langflow interface or API is exposed.
Affected products
- langflow-ai langflow <= 1.0.12
Identifiers
- CVE-2024-42835
- GHSA-56m6-4mhw-h3g5
- PYSEC-2024-279
Timeline
- 2024-07-24: disclosed: Issue reported on GitHub repository
- 2024-10-31: advisory: GitHub Advisory and NVD entry published