Skip to content

CVE-2025-3248

Named by 4 kept items in this workspace.

Search every workspace for CVE-2025-3248. It matches the name as written, so it can find other things that share it.

The items that name it 4

  • Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
    article2026-09-30

    Unauthenticated Python code injection via exec() in Langflow's /api/v1/validate/code endpoint, permitting immediate RCE. Rated High Threat Risk; confirmed exploited in the wild.

  • AI Agent Hacking Writeups
    repo2026-09-17It is written here as CVE-2025-3248 (Langflow, unauthenticated RCE via /api/v1/validate/code).

    Langflow, unauthenticated RCE via /api/v1/validate/code

  • AI Security Briefing
    advisory2026-07-18

    Langflow flaw exploited by bad actors over the past year.

  • AI Security Briefing
    writeup2026-07-18

    Missing-authentication flaw in Langflow allowing anyone who can reach the server to run their own Python code, no login needed. Fixed in Langflow 1.3.0; added to CISA's Known Exploited Vulnerabilities list in May 2025. Exploited by JADEPUFFER as the entry point.

All cves in this workspace.