CRITICAL Actively exploited Used in ransomware CWE-306
CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
9.8/ 10
CVSS 3.1
Critical severity
>99.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- May 5, 2025
- Fix due
- May 26, 2025
- Ransomware
- Known use
Timeline
- Published
- Apr 7, 2025
- Updated
- Nov 8, 2026
- First covered
- Jul 3, 2026
- Latest story
- 4 months ago
Summary
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CWE-306Missing Authentication for Critical Function
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- langflowbefore 1.3.0