CVE-2025-3248 - CVE House

Status published Critical CVE-2025-3248

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

9.8 CVSS

Vulnerability Description

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3248

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Naveen Sunkavally of Horizon3.ai

References

More from langflow-ai

View All →

CVE-2025-68478

Langflow Vulnerable to External Control of File Name or Path

High 7.1

CVE-2025-68477

Langflow vulnerable to Server-Side Request Forgery

High 7.7

CVE-2025-57760

Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation

High 8.8

Affected Vendor

langflow-ai

View all reports →

Affected Software

langflow

Vulnerable Versions:

Timeline

Official Publish: April 7th, 2025

Last Modified: July 14th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application