CVE-2025-34291 PoC — Langflow 访问控制错误漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34291.yaml

Associated Vulnerability

Title:Langflow 访问控制错误漏洞 (CVE-2025-34291)
Description:Langflow是Langflow开源的一个用于构建多代理和 RAG 应用程序的可视化框架。 Langflow 1.6.9及之前版本存在访问控制错误漏洞，该漏洞源于过度宽松的CORS配置和SameSite设置不当，可能导致账户接管和远程代码执行。

Description

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint.

File Snapshot


 id: CVE-2025-34291

info:
  name: Langflow AI <= 1.6.9 - CORS Misconfiguration
  author: 686f6c61
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!