Langflow versions prior to 1

Langflow is a popular low-code builder for LLM/agent workflows. In versions prior to 1.3.0, the /api/v1/validate/code endpoint takes user-submitted Python source, parses it into an AST, and invokes exec() on the result — without authentication and without a sandbox. Attackers embed the payload in a function decorator or default argument value, both of which evaluate at definition time, so the malicious code runs the instant the endpoint compiles it. A single unauthenticated POST yields command execution as the Langflow process user.

The vendor's CRITICAL / 9.8 rating is entirely accurate and, if anything, understated by recent history. CVSS captures the raw primitive; it doesn't capture that Langflow is routinely deployed on internet-facing hosts by data scientists who never intended it to be a hardened production service. AV:N/AC:L/PR:N/UI:N is literal — a curl one-liner is enough.

Why this verdict

• KEV + EPSS 0.99968: listed since 2025-05-05 and actively distributing the Flodrix botnet — exploitation is not theoretical, it is occurring today at scan-and-spray scale.
• Zero prerequisites: unauthenticated, no user interaction, single HTTP POST. There is no friction lever to lean on.
• Role multiplier — AI workflow orchestrator: Langflow instances commonly hold OpenAI/Anthropic/Bedrock keys, connect to vector databases with proprietary embeddings, and increasingly front internal MCP servers. RCE here yields both the host and the AI supply-chain keys. Floor = CRITICAL.
• Shadow-IT prevalence: data-science teams stand these up on cloud VMs outside standard patch pipelines; CMDB coverage is poor, meaning defenders often don't know they own an instance until it's popped.

Why not higher?

CRITICAL is the top severity bucket in this schema. The only reason to escalate operationally beyond the 3-day mitigation SLA is if you know you have exposed instances — in which case treat it as an active incident, not a patch cycle.

Why not lower?

There is no defensible path to HIGH. The bug is unauthenticated, remotely triggerable in a single request, KEV-listed, has a botnet operator behind it, and lives in a component whose deployment context routinely holds high-value secrets. Every downgrade lever noisgate would normally apply is absent.

1. Take exposed Langflow instances off the public internet immediately — Because active KEV exploitation is in progress, the noisgate mitigation SLA of ≤3 days collapses to hours. Front every instance with an SSO-authenticated reverse proxy (Cloudflare Access, Tailscale, oauth2-proxy) or move it into a private VPC — do this before you even schedule the upgrade window.
2. Upgrade to Langflow 1.3.0 or later — The fix adds the CurrentActiveUser dependency to the vulnerable endpoint. Because Langflow is typically pip- or Docker-installed, the upgrade is pip install --upgrade langflow or bumping the container tag. Complete within the noisgate remediation SLA of ≤90 days, but for KEV-listed bugs treat 7 days as the real deadline.
3. Block POST /api/v1/validate/code at the WAF for all instances you cannot immediately upgrade — The endpoint has no legitimate external caller. A WAF/ingress rule dropping unauthenticated POSTs to that path buys time while patching. Pair with a rule matching payload strings __import__, os.system, subprocess in JSON bodies.
4. Rotate every secret the Langflow host had access to — Assume compromise on any instance that was internet-facing between April 2025 and the day you patched: rotate LLM API keys, cloud IAM credentials/instance-profile keys, vector DB creds, and any MCP tokens. Do this within 72 hours of confirming exposure.
5. Hunt for Flodrix and shell-drop IoCs — Search EDR for Langflow/Python parent processes spawning curl, wget, chmod +x, /tmp/* executions, or connections to Flodrix C2s (see Trend Micro IoC list). Any hit is an incident, not a patch.

Run this from an auditor workstation with network reachability to the target Langflow instance. No credentials needed. Usage: ./check_langflow.sh https://langflow.internal.example.com — the script fetches the version endpoint and, if unreachable, attempts a benign echo payload against /api/v1/validate/code to confirm the vulnerable code path.

#!/usr/bin/env bash
# noisgate — CVE-2025-3248 Langflow unauthenticated RCE check
# Usage: ./check_langflow.sh <base_url>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://host:port" >&2
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"

# 1. Try to read version from the API
VER_JSON="$(curl -sk --max-time 10 "$TARGET/api/v1/version" || true)"
VERSION="$(echo "$VER_JSON" | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"

if [[ -n "$VERSION" ]]; then
  # semver compare vs 1.3.0
  IFS='.' read -r MAJ MIN PAT <<<"$(echo "$VERSION" | sed -E 's/[^0-9.].*//')"
  MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}
  if (( MAJ > 1 )) || { (( MAJ == 1 )) && (( MIN >= 3 )); }; then
    echo "PATCHED  Langflow version $VERSION (>= 1.3.0)"
    exit 0
  else
    echo "VULNERABLE  Langflow version $VERSION (< 1.3.0)"
    exit 1
  fi
fi

# 2. Fallback: probe endpoint with a NON-DESTRUCTIVE payload.
# The payload only defines a decorator that raises during import so we
# distinguish "endpoint exists and eval'd" from "endpoint absent".
PROBE='{"code":"def _n():\n    pass"}'
HTTP_CODE="$(curl -sk --max-time 10 -o /tmp/lf_probe.$$ -w '%{http_code}' \
  -H 'Content-Type: application/json' \
  -X POST "$TARGET/api/v1/validate/code" -d "$PROBE" || echo 000)"
BODY="$(cat /tmp/lf_probe.$$ 2>/dev/null || true)"
rm -f /tmp/lf_probe.$$

case "$HTTP_CODE" in
  200)
    if echo "$BODY" | grep -q '"imports"\|"function"'; then
      echo "VULNERABLE  /api/v1/validate/code reachable unauthenticated (HTTP 200)"
      exit 1
    fi
    echo "UNKNOWN  HTTP 200 but unexpected body; inspect manually"
    exit 2
    ;;
  401|403)
    echo "PATCHED  Endpoint requires authentication (HTTP $HTTP_CODE)"
    exit 0
    ;;
  404)
    echo "UNKNOWN  Endpoint not found — not a Langflow host or non-standard path"
    exit 2
    ;;
  *)
    echo "UNKNOWN  HTTP $HTTP_CODE from probe"
    exit 2
    ;;
esac

Sources

1. GitHub Security Advisory GHSA-vwmf-pq79-vjvx
2. NVD — CVE-2025-3248
3. Trend Micro — Langflow / Flodrix botnet campaign
4. Zscaler ThreatLabz — CVE-2025-3248 RCE analysis
5. Recorded Future — Active exploitation report
6. Public PoC — ill-deed/Langflow-CVE-2025-3248-Multi-target
7. SentinelOne vulnerability database entry
8. Miggo vulnerability writeup