Langflow unauthenticated RCE via /api/v1/validate/code (CVE-2025-3248)
Date: 2025
Affected: Langflow <1.3.0
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical

Langflow <1.3.0 is susceptible to code injection in the /api/v1/validate/code endpoint, allowing remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests.


Mitigations:

Architectural layers (MAESTRO):