CVE-2025-3248

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.3.0

Description Langflow is susceptible to unauthenticated remote code execution (RCE) due to missing authentication in the /api/v1/validate/code endpoint. A remote attacker can send crafted HTTP requests containing Python code via the code variable to execute arbitrary commands on the server. This issue has been exploited in the wild by the JadePuffer ransomware, which utilized an autonomous AI agent to perform reconnaissance, steal credentials, move laterally, and encrypt databases without human intervention. Additionally, the vulnerability has been used to deploy the Flodrix botnet for DDoS attacks. The attack chain often involves identifying exposed instances via scanning tools and executing reconnaissance commands such as whoami and printenv before establishing persistence.

Recommendations Update Langflow to version 1.3.0 or higher. As a temporary mitigation, restrict internet access to the API or implement firewall rules to block POST requests to the /api/v1/validate/code endpoint, specifically those containing Python operators such as exec, Exception, import, print, or system in the request body.