CVE-2025-3248

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

critical · 9.8

Known exploited

Fix listed

Langflow

Published Apr 7, 2025, 14:22 UTC

Description

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Reported fixed versions

1.3.0

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.