← Database

CVE-2025-3248

CRITICAL CVSS: 9.8 Published: 2025-04-07 Modified: 2026-07-14

Description

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Affected Platforms

Langflow Langflow

Weakness Type

CWE-306, CWE-94, CWE-306

References