CVE-2025-3248 PoC — Langflow 安全漏洞

Source

Associated Vulnerability

Description

Powerful unauthenticated RCE scanner for CVE-2025-3248 affecting Langflow < 1.3.0

Readme

<img src="https://raw.githubusercontent.com/issamjr/CVE-2025-3248-Scanner/refs/heads/main/img.jpg" />

# CVE-2025-3248 Langflow RCE Scanner

## 🔍 Description

A powerful, unauthenticated RCE scanner for CVE-2025-3248 in vulnerable Langflow instances.

- **CVE**: 2025-3248  
- **Type**: Remote Code Execution (Unauthenticated)  
- **Affected**: Langflow < 1.3.0  
- **Author**: Issam Junior ([@issamiso](https://t.me/issamiso))

---

## 💥 Vulnerability Overview

Langflow's `/api/v1/validate/code` endpoint insecurely executes user-supplied code using Python `exec()`, without authentication or sandboxing. This enables remote attackers to execute arbitrary Python code.

---

## ✅ Protection

- Upgrade to Langflow **1.3.0 or newer**
- Block access to `/api/v1/validate/code`
- Use proper code sandboxing (e.g., Pyodide, Docker, restricted ASTs)

---

## ⚙️ Usage

```bash
git clone https://github.com/issamjr/CVE-2025-3248-Scanner.git
cd CVE-2025-3248-Scanner
pip install -r requirements.txt
python3 scanner.py --url http://example.com/
python3 scanner.py --list targets.txt
```

---

## 🔐 Disclaimer

This tool is for **authorized security research** only. Misuse is prohibited.

---

## 🛠️ Contact

Developer: **Issam Junior**  
Telegram: [@issamiso](https://t.me/issamiso)  
GitHub: [github.com/issamjr](https://github.com/issamjr)

File Snapshot

 [4.0K]  /data/pocs/a2a41aa91187a9219801c3dfb6dffa57f4872dab
├── [ 60K]  img.jpg
├── [1.3K]  README.md
├── [  18]  requirements.txt
└── [2.3K]  scanner.py

0 directories, 4 files

Remarks