CVE-2024-37014: 
Python vulnerability analysis and mitigation

CVE-2024-37014 affects Langflow through version 0.6.19, allowing remote code execution vulnerability when untrusted users can access the 'POST /api/v1/custom_component' endpoint and provide a Python script (NVD, CVE). The vulnerability was discovered and reported on May 25, 2024.

The vulnerability exists in the Custom Component feature of Langflow, which allows users to provide their own Python scripts using the CustomComponent class. When the framework is hosted online, attackers can exploit this feature by submitting malicious Python code through the POST /api/v1/custom_component endpoint. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to execute arbitrary code on the hosting server, potentially leading to data theft, unauthorized access, and service disruption. Successful exploitation could result in complete system compromise, especially when the application is hosted publicly (Github Issue).

The vulnerability is exploitable remotely and requires no user interaction. An attacker only needs access to the /api/v1/custom_component endpoint to submit malicious Python code. A proof-of-concept exploit has been publicly disclosed, demonstrating the ability to execute system commands and exfiltrate data (Github Issue).

Users should upgrade to a version newer than 0.6.19 once available. In the meantime, it is recommended to restrict access to the /api/v1/custom_component endpoint and ensure that only trusted users can access this functionality (NVD).