CVE-2024-48061

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-480639.8In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior iCVE-2024-480686.1A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbiCVE-2024-480699.8A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files anCVE-2024-48078.8A vulnerability, which was classified as critical, has been found in Kashipara College Management System 1.0. This issue affects some unknowCVE-2024-480709.8An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution,CVE-2024-480716.5E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the serCVE-2024-480729.8Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formCVE-2024-480739.8sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updaCVE-2024-480748.0An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into tCVE-2024-480755.3A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attCVE-2024-480777.5NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-CVE-2024-48088.8A vulnerability, which was classified as critical, was found in Kashipara College Management System 1.0. Affected is an unknown function of
CVE-2024-48061: Critical severity, CVSS 9.8 | Vulnix