GHSA-rvqx-wpfh-mfx7 · Severity: critical · Ecosystem: pip — Langflow Unauth RCE
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Conclusion & alert: CVE-2025-3248 is rated Critical Active Threat (100/100): CVSS Critical severity, with high exploitation likelihood (EPSS 99.96%, 100th percentile). Core evidence: CISA KEV confirms active exploitation (added 2025-05-05) affecting Langflow / Langflow. a weakness (CWE-306) Unauthenticated remote administrative access may be possible. EPSS rose +6.80% over the last day, indicating growing attacker interest. Mandatory action: The CISA remediation deadline has passed—treat as an emergency patch priority.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
: Langflow Missing Authentication Vulnerability · CISA KEV detail
: 2025-05-05
: 2025-05-26
: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 52364 | exploit_db | edb | 2025-07-16 | Exploit-DB ↗ |
| 52262 | exploit_db | edb | 2025-04-18 | Exploit-DB ↗ |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 93.16% | 99.96% | +6.80% |
| 2 | 2026-06-13 | 92.98% | 93.16% | +0.17% |
| 3 | 2026-06-12 | — | 92.98% | — |
Full EPSS history (62 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-rvqx-wpfh-mfx7 · Severity: critical · Ecosystem: pip — Langflow Unauth RCE
| URL | Tags |
|---|---|
| https://github.com/langflow-ai/langflow/pull/6911 | Patch |
| https://github.com/langflow-ai/langflow/releases/tag/1.3.0 | Release Notes |
| https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/ | Exploit Third Party Advisory |
| https://www.vulncheck.com/advisories/langflow-unauthenticated-rce | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248 | US Government Resource |