CVE-2025-3248

Langflow versions prior to 1.3.0

Langflow is vulnerable to an unauthenticated remote code execution (RCE) vulnerability (CVE-2025-3248) due to a missing authentication check in the

/api/v1/validate/code

endpoint. This allows attackers to execute arbitrary code on vulnerable systems without authentication. The Flodrix botnet is actively exploiting this vulnerability to deploy malware, including DDoS attacks and data theft. The vulnerability has a CVSS score of 9.8 and is considered critical. Exploitation involves sending crafted HTTP requests to the vulnerable endpoint. Proof-of-concept exploits are publicly available. The vulnerability has been added to CISA’s KEV catalog. Approximately 466 servers are currently exposed.

Update Langflow to version 1.3.0 or later. Restrict network access to the vulnerable endpoint as a temporary mitigation.