PT-2025-15232 · Langflow · Langflow
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Langflow versions prior to 1.3.0
Description
Langflow is susceptible to unauthenticated remote code execution (RCE) due to missing authentication in the
/api/v1/validate/code endpoint. A remote attacker can send crafted HTTP requests containing Python code via the code parameter to execute arbitrary commands on the server. This issue has been exploited in the wild by the Flodrix botnet and the JadePuffer ransomware. In the JadePuffer incident, an autonomous LLM agent utilized this flaw to perform a full kill chain, including reconnaissance, credential theft of cloud API keys, lateral movement to production databases, and data encryption. The agent demonstrated high autonomy by diagnosing and fixing failed login attempts in 31 seconds and using self-documenting code. The attack targeted MySQL production servers and Alibaba Nacos services, utilizing the AES ENCRYPT() function for data destruction.Recommendations
Update Langflow to version 1.3.0 or higher.
Restrict internet access to the API.
Block POST requests to the
/api/v1/validate/code endpoint that contain Python operators such as exec, Exception, import, print, or system in the request body.
Network-segment Langflow instances away from production database servers.
Rotate all cloud API keys, database credentials, and cryptocurrency wallet keys accessible from affected hosts.
Audit systems for crontab entries with a 30-minute callback interval to detect persistence.Exploit
Fix
LPE
RCE
Missing Authentication
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Langflow