CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
KEV RANSOMWARECRITICAL 9.3EPSS 100.0%
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode.
- Affected
- langflow-ai · langflow
- CVSS v4.0 GitHub
- 9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A - CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 99.99% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-05-05, used in ransomware campaigns
- Nuclei
- critical · CWE-306
- Published
- 2025-04-07
- Updated
- 2026-10-08
Proof-of-concept exploits (32)
- https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-ex…
- 0-d3y/langflow-rce-exploit7★ · 2025-06-23
- 0xgh057r3c0n/CVE-2025-32480★ · 2025-06-18
- EQSTLab/CVE-2025-32483★ · 2025-09-17
- J4c0b-1337x007/ethical-exploit-playground0★ · 2025-08-10
- MatDupas/Custom-Nmap-Scripts0★ · 2025-06-30
- Praison001/CVE-2025-32481★ · 2025-05-05
- PuddinCat/CVE-2025-3248-POC3★ · 2025-04-10
- Vip3rLi0n/CVE-2025-32481★ · 2025-05-27
- adolfcg/mixtli250★ · 2025-08-01
- dennisec/Mass-CVE-2025-32483★ · 2025-06-23
- ill-deed/Langflow-CVE-2025-3248-Multi-target0★ · 2025-07-27
- imbas007/CVE-2025-32482★ · 2025-06-18
- min8282/CVE-2025-32480★ · 2025-09-17
- preemware/langflow-exploit1★ · 2026-08-09
- r0otk3r/CVE-2025-32481★ · 2025-07-12
- tiemio/RCE-CVE-2025-32481★ · 2025-05-31
- verylazytech/CVE-2025-324810★ · 2025-04-16
- vigilante-1337/CVE-2025-32482★ · 2025-05-13
- wand3rlust/CVE-2025-32480★ · 2026-01-08
- xuemian168/CVE-2025-324811★ · 2025-04-10
- ynsmroztas/CVE-2025-3248-Langflow-RCE17★ · 2025-06-17
- zapstiko/CVE-2025-32482★ · 2025-06-19
- hideki233/CVE-2025-3248-Langflow-RCE3★ · 2026-08-28
- 12-test-12/CVE-2025-32480★ · 2026-03-16
- GraySignal/CVE-2025-32481★ · 2025-05-05
- Kiraly07/Demo_CVE-2025-32482★ · 2025-10-01
- b0ySie7e/CVE-2025-3248-POC1★ · 2025-12-10
- bambooqj/cve-2025-32481★ · 2025-10-24
- drackyjr/cve-2025-3248-exploit3★ · 2025-11-21
- Hann1bl3L3ct3r/BishengBang0★ · 2026-06-11
- paniby/kr-vulhub0★ · 2026-07-12
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (2)
Vulhub environments (1)
Security advisories
- https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-ex…
- https://www.vulncheck.com/advisories/langflow-unauthenticated-rce
- advisories/GHSA-rvqx-wpfh-mfx7
- langflow-ai/langflow/pull/6911