Microsoft Azure PromptFlow Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Microsoft Azure PromptFlow, specifically in the PromptFlow tools and core components. This issue arises from improper isolation or compartmentalization, which allows an unauthorized attacker to execute code over a network. The vulnerability affects Azure PromptFlow versions 1.6.0 and 1.17.2, released on March 11, 2025.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can upgrade to Azure PromptFlow version 1.6.0 for the tools component or version 1.17.2 for the core component to address this vulnerability.