{"action":"Upgrade promptflow-core to 1.17.2 or later.","affected":[{"fixed":"1.17.2","introduced":"0"}],"component":"promptflow-core","cve_ids":["CVE-2025-24986"],"ecosystem":"PyPI","epss":0.00539,"exploited":false,"fixed_versions":["1.17.2"],"ghsa_id":"GHSA-gprr-v9f2-px3c","id":"tcs_01M5KGVSJ4X1QXRNTY00DY4EVC","modified_at":"2026-07-13T16:43:17.482107065Z","published_at":"2026-07-07T14:34:50.579144Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1804","https://nvd.nist.gov/vuln/detail/CVE-2025-24986","https://github.com/microsoft/promptflow/commit/5f4a41ab4cb15607ade7f26138b0b863b4e4eb0a","https://github.com/microsoft/promptflow/commit/625061724c51533d28fe6e0e3014b1042afdb07f","https://github.com/microsoft/promptflow","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24986","https://pypi.org/project/promptflow-core","https://github.com/advisories/GHSA-gprr-v9f2-px3c"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1804","url":"https://osv.dev/vulnerability/PYSEC-2026-1804"}],"summary":"Azure PromptFlow remote code execution related to Jinja templates"}