Langflow - RCE (CVE-2025-3248)
Description
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
psychologyCrowdSec Analysis
CVE-2025-3248 is a critical vulnerability in Langflow that allows unauthenticated remote code execution through a code injection flaw in a validation endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 31st of March 2025.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-3248 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-3248 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Observed exploitation attempts are aimed at URLs containing /api/v1/validate/code.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| Rule Released | 2025-03-31 |
| CVE Published | 2025-04-07 |
| CISA KEV | 2025-05-05 |
| CrowdSec First Seen | 2025-05-07 |
| CISA Remediation Deadline | 2025-05-26 |