CyberRota Analysis
AI-GeneratedIBM Langflow OSS versions 1.0.0 to 1.10.1 are vulnerable to an unauthenticated remote code execution flaw in the public flow build endpoint, allowing attackers to execute arbitrary code due to an incomplete denylist in the validation function. This vulnerability poses a high risk, potentially leading to unauthorized access and control over affected systems. Organizations using these versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.
Related CVEs
Other vulnerabilities affecting the same vendor(s)