IBM Langflow Desktop FAISS Component Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability has been identified in IBM Langflow Desktop versions 1.6.0 through 1.8.2. This issue arises from the FAISS component's default setting, which allows the deserialization of untrusted Python Pickle files. An authenticated user could exploit this vulnerability by uploading a malicious Pickle file, leading to arbitrary code execution with the privileges of the backend service.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the system where Langflow Desktop is running.
Remediation
Users are advised to upgrade to IBM Langflow Desktop version 1.8.3 or newer. Instructions for downloading the latest version are available on the Langflow website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.