Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.3.0, 0.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 on Exploit-DB
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
Langflow, an open-source tool for building AI workflows, is affected by this vulnerability. An unauthenticated remote attacker could send crafted requests to the code validation endpoint and execute arbitrary code on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-52262, EDB-52364
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- langflow-ai langflow
fixed in 1.3.0
- langflowPyPI
fixed in 1.3.0
- langflow-basePyPI
fixed in 0.3.0
References 6
GitHub · langflow-ai/langflow
horizon3.ai
vulncheck.com
Exploit-DB
Questions about CVE-2025-3248
What does this mean?
The /api/v1/validate/code endpoint in Langflow lets an unauthenticated remote attacker run code on the Langflow server, which can lead to full control of that server.Source: horizon3.ai
Am I affected, and how do I check?
Langflow versions prior to 1.3.0 are affected, and the langflow-base package is affected below 0.3.0. To check, look at the installed Langflow version and confirm whether it is earlier than 1.3.0.Source: horizon3.ai
What should I do about it?
Upgrade Langflow to 1.3.0 or later, which the vendor says patches the issue and recommends for all users.Source: horizon3.ai
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-05-05, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data