{"id":"CVE-2025-3248","kind":"vulnerability","aliases":["CVE-2025-3248"],"related":[],"title":"Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint","description":"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Langflow, an AI workflow builder, has an unauthenticated endpoint at /api/v1/validate/code that runs code sent by the caller. An remote attacker with no account can send crafted HTTP requests to execute arbitrary code on the server and is listed as exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-05-05T00:00:00+00:00","products":[{"name":"Langflow Langflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"langflow","fixed":["1.3.0"],"affected":"< 1.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","exploited","langflow","ransomware","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Check whether the Langflow version in use is affected; the sources do not give the affected version range.\nRequest /api/v1/validate/code without credentials on your instance and see whether it responds.","fix":"Upgrade Langflow to a version that adds authentication to /api/v1/validate/code; the sources do not name the fixed version.\nIf no fix is available, restrict access to the Langflow instance or stop using it, as CISA advises.","status":"open","published_at":"2025-04-07T15:15:44+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:41+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T20:48:41Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Langflow to a version that adds authentication to /api/v1/validate/code; the sources do not name the fixed version.\nIf no fix is available, restrict access to the Langflow instance or stop using it, as CISA advises.","reach":"internet","summary":"Langflow, an AI workflow builder, has an unauthenticated endpoint at /api/v1/validate/code that runs code sent by the caller. An remote attacker with no account can send crafted HTTP requests to execute arbitrary code on the server and is listed as exploited in the wild.","category":"ai-tooling","who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Langflow server without logging in.","analyst_note":"Find the fixed Langflow version and affected range from the vendor advisory or NVD entry for CVE-2025-3248, and confirm whether the endpoint is reachable by default.","how_to_check":"Check whether the Langflow version in use is affected; the sources do not give the affected version range.\nRequest /api/v1/validate/code without credentials on your instance and see whether it responds.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000494,"input_tokens":2546,"output_tokens":479,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':116C '-2025':16A,19A '-3248':17A,20A '/api/v1/validate/code':13A,46B,88C '1.3.0':5A '22':115C 'account':59B 'action':106C 'agent':26B 'ai':25B,28B,38B 'ai-ag':24B 'ai-tool':27B 'allow':91C 'appli':107C 'applic':113C 'arbitrari':67B,98C 'attack':56B,95C 'authent':84C 'bod':114C 'builder':40B 'caller':53B 'cisa':104C 'cloud':119C 'code':9A,49B,68B,99C 'contain':81C 'craft':62B,101C 'cve':15A,18A 'discontinu':122C 'endpoint':14A,44B,89C 'execut':66B,97C 'exploit':30B,76B 'follow':112C 'guidanc':117C 'host':35B 'http':63B,102C 'inject':10A 'instruct':111C 'langflow':1A,21A,22A,23A,31B,36B,80C 'list':74B 'miss':83C 'mitig':108C,128C 'per':109C 'prior':3A 'product':126C 'ransomwar':32B 'remot':55B,93C 'request':64B,103C 'requir':105C 'run':48B 'self':34B 'self-host':33B 'send':61B 'sent':50B 'server':71B 'servic':120C 'suscept':7A 'tool':29B 'unauthent':43B,94C 'unavail':130C 'use':123C 'vendor':110C 'version':2A 'via':100C 'vulner':85C 'wild':79B 'workflow':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-04-07T15:15:44+00:00","kev":{"dateAdded":"2025-05-05","dueDate":"2025-05-26","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-3248","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3248","severity":null,"published_at":"2025-05-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-3248","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3248","severity":null,"published_at":"2025-04-07T15:15:44+00:00","modified_at":"2026-10-08T16:16:52+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}