CVE-2025-3248Discovered Published
Langflow: unauthenticated code execution in the validation API (CVE-2025-3248)
Advisory record · Vendor advisory
Status. Two-tier request-filter comparison against Eden 1.103.0 using a synthetic HTTP fixture.
The vulnerability
Langflow before 1.3.0 can execute Python supplied in unauthenticated requests to the code-validation endpoint.
The Eden patch
Tier 1 — declarative policy. Deny all requests under the fixture prefix /api/v1/validate/code, including benign requests.
Tier 2 — native Rust module. Match /api/v1/validate/code and refuse requests containing a configured marker in the body.
Measured comparison (2026-11-12 UTC)
| Configuration | Benign request | Attack fixture |
|---|---|---|
| Baseline | HTTP 200 | HTTP 200, backend marker recorded |
| Tier 1 route deny | HTTP 403 | HTTP 403 |
| Tier 2 native module | HTTP 200 | HTTP 403, backend marker absent |
Signed module authority
The module was imported for explicit activation. All expected shards acknowledged activation. Reader inspection, a tampered statement and an invalid signature were rejected. After revocation the same request received HTTP 503. Re-approval and reactivation restored HTTP 403.
Test scope
The synthetic route matches the advisory's code-validation route. The fixture records a request marker. Coverage of arbitrary Python syntax and execution behavior remains unverified.
The measurements cover the supplied fixture probes. Alternate routes, encodings, and other bypasses remain untested.