vendor:
Langflow
by:
VeryLazyTech
6.1
CVSS
HIGH
Remote Code Execution (RCE)
78
CWE
Product Name: Langflow
Affected Version From: Langflow < 1.3.0
Affected Version To: Langflow 1.3.0
Patch Exists: YES
Related CWE: CVE-2025-3248
CPE: Langflow
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=99095, https://www.infosecmatter.com/nessus-plugin-library/?id=50046, https://www.infosecmatter.com/nessus-plugin-library/?id=155239, https://www.infosecmatter.com/nessus-plugin-library/?id=99119, https://www.infosecmatter.com/nessus-plugin-library/?id=99038, https://www.infosecmatter.com/nessus-plugin-library/?id=151817, https://www.infosecmatter.com/nessus-plugin-library/?id=99098
Platforms Tested: Windows Server 2019
2025
Langflow 1.3.0 – Remote Code Execution (RCE)
Langflow version < 1.3.0 is vulnerable to remote code execution (RCE) due to a lack of proper input validation. An attacker can exploit this by sending crafted HTTP requests, leading to the execution of arbitrary code on the target system. This vulnerability has been assigned CVE-2025-3248.
Mitigation:
To mitigate this vulnerability, users should update Langflow to version 1.3.0 or newer, which includes patches to address this RCE issue. Additionally, it is recommended to implement proper input validation mechanisms to prevent such exploits.
