CVE-2025-3248 PoC — Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

Source

https://github.com/Vip3rLi0n/CVE-2025-3248

Associated Vulnerability

Title: Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code (CVE-2025-3248)
Description:Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Description

Perform Remote Code Execution using vulnerable API endpoint.

Readme

# CVE-2025-3248 ![](https://img.shields.io/badge/license-MIT-blue.svg)
Remote Code Execution using vulnerable API endpoint Proof of Concept.

 Info:
- ⚠️ Use this at your own risk!
- ❓ Added option to reverse shell.
- ✅ Auto retry if validate_code is off.

## Showcase
![showcase](https://github.com/user-attachments/assets/f1749a02-acec-405c-8c21-0aa75260697b)

## Usage

    python CVE-2025-3248.py / python3 CVE-2025-3248.py

## Footprint
```
By using this tool, you agree that you are using it for educational purposes only and that you will not use it for any illegal activity.
You also agree to bear all risks associated with the use of this tool.
I will not be responsible for direct or indirect damage caused by the use of this tool.
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →