CVE-2025-3248: Langflow Missing Authentication Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references.
Original Description
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Other sources
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
— CISA
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/langflowto a version that resolves this vulnerability.Fixed in 1.3.0 - Upgrade
Upgrade
pip/langflow-baseto a version that resolves this vulnerability.Fixed in 0.3.0 - Upgrade
Upgrade
Langflowto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3248?
The severity of CVE-2025-3248 is critical due to its potential for remote code execution.
How do I fix CVE-2025-3248?
To fix CVE-2025-3248, upgrade to Langflow version 1.3.0 or later.
Who is affected by CVE-2025-3248?
CVE-2025-3248 affects all versions of Langflow prior to 1.3.0.
Can CVE-2025-3248 be exploited remotely?
Yes, CVE-2025-3248 can be exploited remotely by unauthenticated attackers.
What type of vulnerability is CVE-2025-3248?
CVE-2025-3248 is a code injection vulnerability.