CVE-2025-3248 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Langflow sites for it with a live exploit check.
Detects Langflow instances that run code supplied by anyone who can reach them, with no login at all. Every version before 1.3.0 exposes a code-validation endpoint without an authentication check, and that endpoint does more than check the code: it compiles each function definition it is handed and runs it. Running a function definition does not call the function, but it does evaluate the definition's default arguments, so an expression parked in a default argument executes inside the server process. Langflow then returns the text of any resulting error to the caller, which hands the attacker the command output in the same response. The verifier sends one such definition whose default argument shells out to print a per-scan marker, the product of two random numbers, and the account id the server runs as. Only the two factors are ever sent, so a reply carrying their product proves the target's own shell did the multiplication rather than echoing anything. A control request with a constant default argument travels the same code path and comes back with an empty error list, so the finding is the code injection and not merely a reachable endpoint. CVSS 9.8, CISA KEV since May 2025 and under active exploitation. Upgrade to Langflow 1.3.0 or later and set LANGFLOW_AUTO_LOGIN to false, because with auto-login left on Langflow resolves the configured superuser for anonymous callers and the fix on this route never asks for a credential.
Is your app exploitable through CVE-2025-3248?
Scan your domain free