CVE-2025-24986
CVE-2025-24986 · Azure Promptflow Remote Code Execution Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
CVSS 6.5 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
azure promptflow-core
- Versions
- ≥ 1.0.0, < 1.17.2: Affected (custom)
Update to 1.17.2
azure promptflow-tools
- Versions
- ≥ 1.0.0, < 1.6.0: Affected (custom)
Update to 1.6.0
promptflow-tools PyPI
- Versions
- 0.1.0b1
- 0.1.0b10
- 0.1.0b11
- 0.1.0b12
- 0.1.0b15
- 0.1.0b5
- 0.1.0b6
- 0.1.0b8
- 0.1.0b9
- 1.0.0
- 1.0.1
- 1.0.2
- 1.0.3
- 1.1.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- Affected ranges
- ECOSYSTEM: < 1.6.0
Update to 1.6.0
promptflow-core PyPI
- Versions
- 0.1.0b1
- 1.10.0
- 1.10.1
- 1.11.0
- 1.12.0
- 1.13.0
- 1.14.0
- 1.15.0
- 1.15.0.post1
- 1.15.1
- 1.16.0
- 1.16.1
- 1.16.2
- 1.17.0
- 1.17.1
- 1.8.0
- 1.9.0
- Affected ranges
- ECOSYSTEM: < 1.17.2
Update to 1.17.2