Back to the CVE list
CVE-2025-3248 CISA KEV · Actively exploitedLinked to ransomwareSuited to automated attack · CISA

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

CVSS score

9.8

EPSS probability

%100.0

Risk score

19.6

Published

1 y ago

OverviewPublic Exploits (11)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
zoly-zoly/CVE-2025-3248
GitHub

An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.

Public PoCSource updated: 13.10.2026 19:35:07
G
hideki233/CVE-2025-3248-Langflow-RCE
GitHub

hideki233/CVE-2025-3248-Langflow-RCE

Public PoCSource updated: 15.09.2026 22:07:17
G
preemware/langflow-exploit
GitHub

PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code.

Public PoCSource updated: 10.08.2026 18:01:07
G
nebari-playground/langflow-cve-2025-3248
GitHub

Langflow at pre-CVE-2025-3248 fix commit for variant analysis benchmarking

Public PoCSource updated: 20.03.2026 17:44:24
G
12-test-12/CVE-2025-3248
GitHub

12-test-12/CVE-2025-3248

Public PoCSource updated: 29.03.2026 05:56:23
G
wand3rlust/CVE-2025-3248
GitHub

PoC for achieving RCE in Langflow versions <1.3.0

Public PoCSource updated: 02.10.2025 10:48:06
G
b0ySie7e/CVE-2025-3248-POC
GitHub

b0ySie7e/CVE-2025-3248-POC

Public PoCSource updated: 15.03.2026 03:07:50
G
drackyjr/cve-2025-3248-exploit
GitHub

A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0.

Public PoCSource updated: 13.02.2026 15:54:54
E
Langflow 1.2.x - Remote Code Execution (RCE)
Exploit-DB

Langflow 1.2.x - Remote Code Execution (RCE)

Exploit referenceSource updated: 16.07.2025 00:00:00
E
Langflow 1.3.0 - Remote Code Execution (RCE)
Exploit-DB

Langflow 1.3.0 - Remote Code Execution (RCE)

Exploit referenceSource updated: 18.04.2025 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-3248.yaml
Nuclei

Nuclei: Langflow AI - Unauthenticated Remote Code Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-3248"