Langflow Unauthenticated Code Injection

Product: Langflow Langflow
CVE: CVE-2025-3248
Disclosed: 2025-04-07
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Langflow < 1.3.0
Fixed: 1.3.0

Summary

Langflow, a popular visual builder for LLM agents and RAG pipelines, exposed a code-validation endpoint that required no login. Anyone who could reach the server could make it run arbitrary Python. It was exploited in the wild (including by the Flodrix botnet) and added to CISA KEV.

Root cause

POST /api/v1/validate/code parsed user-supplied Python with ast and then called compile()/exec() on function definitions to 'validate' them. Python evaluates decorators and default-argument expressions at definition time, so payloads placed in a decorator or default value execute immediately without the function ever being called. The endpoint had no authentication check.

Impact

Unauthenticated remote code execution as the Langflow process, exposing every API key and credential stored in flows.

Public PoC

POST /api/v1/validate/code HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"code": "@exec('raise Exception(__import__(\"subprocess\").check_output([\"cat\", \"/etc/passwd\"]))')\ndef foo():\n  pass"}

Source: Horizon3.ai - Unsafe at Any Speed

Detection

Look for POST requests to /api/v1/validate/code from unauthenticated clients, especially bodies containing '@exec', '__import__' or 'subprocess'. Horizon3 published a nuclei template (CVE-2025-3248); check /api/v1/version for < 1.3.0.

Mitigation

Upgrade to 1.3.0 or later (ideally the latest release, which also fixes follow-on Langflow RCEs) and never expose Langflow directly to the internet.