Langflow Unauthenticated Code Execution (CVE-2025-3248)

What to do

1. Find every instance: pip show langflow in virtualenvs, docker ps / image tags for langflowai/langflow, and an external scan of your IP space for the Langflow UI.
2. Upgrade to Langflow 1.3.0 or later (pip install -U langflow), preferably the current release.
3. Take Langflow off the public internet; put it behind VPN, SSO or an authenticating proxy in an isolated network.
4. For any instance that was exposed while below 1.3.0, rebuild it from a clean image and rotate every secret it held (LLM API keys, database credentials, cloud tokens, environment variables).
5. Block or alert on POST requests to /api/v1/validate/code from untrusted sources at your proxy or WAF.

How to check if you are affected or compromised

• Search web and proxy logs for POST /api/v1/validate/code, especially unauthenticated requests or bodies containing decorators like @exec or subprocess calls.
• Look for unexpected child processes of the Langflow Python process (sh, curl, wget, busybox) and new files in /tmp such as Flodrix's /tmp/e1x variants or a hidden .system_idle file.
• Check egress for connections to the C2 IPs and ports (e.g. TCP 54707) listed in Trend Micro's IoC file, and for unusual outbound DDoS-like traffic.

What happened#

Langflow is a popular open-source visual builder for LLM agents and workflows. It shipped an endpoint, /api/v1/validate/code, that was meant to check user-written Python components. The endpoint required no authentication, and it passed the submitted code to Python's exec. Horizon3.ai researcher Naveen Sunkavally explained the trick. The code was parsed with ast and only imports and function definitions were kept. But Python evaluates decorators, and default argument values, at the moment a function is defined, not when it is called. A payload like @exec("...") therefore ran immediately, giving any remote visitor code execution on the server.

The flaw is tracked as CVE-2025-3248. The GitHub advisory describes it as code injection (CWE-94) in langflow before 1.3.0 and langflow-base before 0.3.0, rated CVSS 4.0 9.3. Trend Micro cites a CVSS score of 9.8. The fix in 1.3.0, released March 31, 2025, put the endpoint behind authentication. The CVE was published on April 7, and a third-party exploit appeared on April 9.

Who is affected#

According to Horizon3, most if not all Langflow versions before 1.3.0 are affected, since the vulnerable code went back to the earliest releases. Turning on Langflow's own authentication did not help, because the endpoint skipped it. At the time, Horizon3 counted 500+ Langflow instances exposed to the internet on Censys. These AI tools are often stood up quickly for demos or experiments, so shadow-IT deployments are a real concern.

Do you really need to act?#

If you never deployed Langflow, no. If you did, this is one of the clearer cases where exposure decides everything. Exploitation needs one unauthenticated HTTP request, public exploits exist, and attackers use them. CISA added CVE-2025-3248 to KEV on May 5, 2025. The KEV snapshot of October 21, 2026 marks its use in ransomware campaigns as "Known". In June 2025 Trend Micro documented a campaign that scanned for exposed Langflow servers, ran reconnaissance, and installed the Flodrix DDoS botnet.

Because the patch is about 19 months old, a maintained instance is almost certainly fine. An old container or forgotten VM that was internet-facing below 1.3.0 is a different story. Assume it was found and exploited, and remember that Langflow servers usually hold LLM provider keys and database credentials.

What to do now#

1. Inventory instances with pip show langflow, docker ps and image tags, plus an external scan of your address space.
2. Upgrade to 1.3.0 or later (pip install -U langflow). Prefer the latest release.
3. Remove public exposure. Put Langflow behind VPN, SSO or an authenticating proxy in an isolated VPC, as Horizon3 recommends.
4. For any instance that was exposed while vulnerable, rebuild from a clean image and rotate every secret it held.
5. Add a proxy or WAF rule that alerts on /api/v1/validate/code requests from untrusted sources.

How to tell if you were hit#

Search access logs for POST /api/v1/validate/code without a valid session, and for request bodies with decorators, subprocess or shell commands. On the host, look for shells, curl or wget launched by the Langflow process. Trend Micro's Flodrix IoCs include a downloader named "docker", /tmp/e1x-style binaries, a hidden .system_idle file, and C2 traffic on TCP 54707. Their article links the full list of hashes and IPs. Any hit means the secrets and data on that host should be treated as exposed.

Timeline#

• Feb 22, 2025 — Horizon3.ai reports the flaw to Langflow.
• Mar 5, 2025 — Fix pull request merged.
• Mar 31, 2025 — Langflow 1.3.0 released.
• Apr 7, 2025 — CVE-2025-3248 published.
• Apr 9, 2025 — Third-party exploit and Horizon3 write-up published.
• May 5, 2025 — CISA adds CVE-2025-3248 to KEV.
• Jun 17, 2025 — Trend Micro reports the Flodrix botnet campaign.

Vulnerability records

• CVE-2025-3248 · KEV 2025-05-05 · Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. GitHub Advisory — Langflow code injection in /api/v1/validate/code (GHSA-rvqx-wpfh-mfx7) github.com
2. Horizon3.ai — Unsafe at Any Speed: Abusing Python exec for unauth RCE in Langflow AI horizon3.ai
3. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (May 5, 2025) cisa.gov
4. Trend Micro — Langflow vulnerability exploited to deliver Flodrix botnet trendmicro.com