Published: 07/04/2025 Updated: 08/04/2025

Code Injection Vulnerability in Langflow Versions Prior to 1.3.0

Langflow versions before 1.3.0 have a code injection vulnerability in the /api/v1/validate/code endpoint. This security issue allows a remote and unauthenticated attacker to send specially crafted HTTP requests that can execute arbitrary code on the system. The vulnerability poses a significant risk as it enables potential unauthorized code execution without requiring any prior authentication.

Vulnerable Product	Search on Vulmon	Subscribe to Product
langflow-ai langflow

A vulnerability scanner for CVE-2025-3248 in Langflow applications.

中文｜ English Langflow Vulnerability Scanner A vulnerability scanner for CVE-2025-3248 in Langflow applications Features Scan single target or multiple targets using FOFA Execute system commands on vulnerable targets Retrieve system information Custom payload support Progress bar for FOFA scanning Beautiful CLI interface Installation Clone the repository: git clone ht

POC of CVE-2025-3248

CVE-2025-3248-POC POC of CVE-2025-3248 usage: python pocpy 'xxxcom' 'ls /' leave some love on victims' computers pocpy

POC - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code - CVE-2025-3248 Overview Langflow versions prior to 130 are susceptible to code injection in the /api/v1/validate/code endpoint A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code Read about it — CVE-2025-3248 Disclaimer: Th

CWE-306 https://nvd.nist.gov https://github.com/xuemian168/CVE-2025-3248 https://www.first.org/epss https://github.com/langflow-ai/langflow/pull/6911 https://github.com/langflow-ai/langflow/releases/tag/1.3.0

CVE-2025-3248

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect