CVE-2025-3248

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.3.0

Description Langflow is susceptible to unauthenticated remote code execution (RCE) due to missing authentication in the /api/v1/validate/code endpoint. A remote attacker can send crafted HTTP requests containing Python code (often Base64 encoded) via the code parameter to execute arbitrary commands on the server. This issue has been exploited by the Flodrix botnet and the JADEPUFFER autonomous AI agent. In the JADEPUFFER incident, the agent independently performed reconnaissance, stole cloud API keys and database credentials, established persistence via cron jobs, and executed a ransomware attack that encrypted and destroyed database records. The agent demonstrated high autonomy, diagnosing and fixing a failed login attempt in 31 seconds.

Recommendations Update Langflow to version 1.3.0 or later. Restrict internet access to the API. Block POST requests to the /api/v1/validate/code endpoint that contain Python operators such as exec, Exception, import, print, or system in the request body. Network-segment Langflow instances away from production database servers. Rotate all cloud API keys, database credentials, and cryptocurrency wallet keys accessible from affected hosts. Audit systems for crontab entries with a 30-minute callback interval to detect potential persistence.