Critical severity · published Apr 7, 2025
CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 5, 2025
Federal remediation dueMay 26, 2025
Ransomware campaign useKnown
Affected products
Which versions
LA
langflow · langflow-ai
before 1.3.0 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3248
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
issue-tracking
https://github.com/langflow-ai/langflow/pull/6911
release-notes
https://github.com/langflow-ai/langflow/releases/tag/1.3.0
exploit
https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/
third-party-advisory
https://www.vulncheck.com/advisories/langflow-unauthenticated-rce
More from langflow
9.8
CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
8.4
CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
9.9
CVE-2026-105740
Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
9.9
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
9.9
CVE-2026-33873
Langflow has Authenticated Code Execution in Agentic Assistant Validation