{"action":"Upgrade promptflow-tools to 1.6.0 or later.","affected":[{"fixed":"1.6.0","introduced":"0"}],"component":"promptflow-tools","cve_ids":["CVE-2025-24986"],"ecosystem":"PyPI","epss":0.00539,"exploited":false,"fixed_versions":["1.6.0"],"ghsa_id":"GHSA-gprr-v9f2-px3c","id":"tcs_01M5KFJ0Y0VXFKRXRNEB9BHG7S","modified_at":"2026-07-13T16:43:17.482107065Z","published_at":"2025-03-11T18:32:18Z","references":["https://osv.dev/vulnerability/GHSA-gprr-v9f2-px3c","https://nvd.nist.gov/vuln/detail/CVE-2025-24986","https://github.com/microsoft/promptflow/commit/5f4a41ab4cb15607ade7f26138b0b863b4e4eb0a","https://github.com/microsoft/promptflow/commit/625061724c51533d28fe6e0e3014b1042afdb07f","https://github.com/microsoft/promptflow","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24986"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gprr-v9f2-px3c","url":"https://osv.dev/vulnerability/GHSA-gprr-v9f2-px3c"}],"summary":"Azure PromptFlow remote code execution related to Jinja templates"}