diff --git a/advisories/unreviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json b/advisories/github-reviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json similarity index 51% rename from advisories/unreviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json rename to advisories/github-reviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json index 17364d18ab0..2b554c1347e 100644 --- a/advisories/unreviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json +++ b/advisories/github-reviewed/2024/11/GHSA-5p5r-57fx-pmfr/GHSA-5p5r-57fx-pmfr.json @@ -1,27 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-5p5r-57fx-pmfr", - "modified": "2024-11-05T00:31:28Z", + "modified": "2024-11-05T16:07:04Z", "published": "2024-11-05T00:31:28Z", "aliases": [ "CVE-2024-48061" ], + "summary": "Langflow vulnerable to remote code execution", "details": "langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.", "severity": [ - + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "langflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.18" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48061" }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/issues/696" + }, { "type": "WEB", "url": "https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61" }, + { + "type": "PACKAGE", + "url": "https://github.com/langflow-ai/langflow" + }, { "type": "WEB", "url": "https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8" @@ -29,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-05T16:07:04Z", "nvd_published_at": "2024-11-04T23:15:04Z" } } \ No newline at end of file