This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. The catalog records known ransomware use. CISA added it on May 5, 2025.

CriticalVulnerability

CVE-2025-3248: Langflow code injection in /api/v1/validate/code endpoint

Source: NVD(opens in a new tab)
Identifier: CVE-2025-3248
Published: April 7, 2025
Record updated: October 10, 2026

View JSON

Affected: langflow < 1.3.0, fixed in 1.3.0, released March 31, 2025, 7 days before disclosure
langflow-base < 0.3.0, fixed in 0.3.0, released March 31, 2025, 7 days before disclosure
Known exploitation: Listed in the CISA Known Exploited Vulnerabilities catalog since May 5, 2025, with known ransomware use.
EPSS: 100.0%

Summary

CVE-2025-3248 affects Langflow versions prior to 1.3.0. A remote, unauthenticated attacker can send crafted HTTP requests to the /api/v1/validate/code endpoint to inject code and execute arbitrary code. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog, with a due date of 05/26/2025.

Mitigation

Fixed in 1.3.0 (release tag https://github.com/langflow-ai/langflow/releases/tag/1.3.0; fix referenced in pull request https://github.com/langflow-ai/langflow/pull/6911).

Details

Scores and exploitation

CVSS score: 9.8(critical)
Patch available: Yes
EPSS: 100.0%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Known exploitation: Listed in CISA KEV, known ransomware use

Weaknesses and techniques

Weakness (CWE): CWE-306
CWE-94
CWE-306
Attack pattern (CAPEC): CAPEC-115
CAPEC-242

Affected

Packages: langflow@< 1.3.0 (fixed: 1.3.0)
langflow-base@< 0.3.0 (fixed: 0.3.0)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Framework
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-3248

First tracked: February 15, 2026 at 08:48 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

langflowPyPIReaches an LLM package through dependencies
langflow-basePyPILLM dependency since 2024-04-01 · 1 tracked dependent

Coverage

News, research and other items that mention CVE-2025-3248.

The AI app builder your team trusts has a root-level backdoorCSO Online · 2026-10-06

Summary

Mitigation

Affected packages in the Exposure Registry

Coverage

Related items