CVE-2025-3248 is a critical RCE vulnerability in Langflow <1.3.0, caused by unsafe use of Python’s exec() in the /api/v1/validate/code endpoint, allowing unauthenticated attackers to execute arbitrary code via decorators or default arguments. This can lead to full system compromise without authentication. Public PoCs exist, and active exploitation has been observed. Upgrade to Langflow 1.3.0 or restrict endpoint access immediately to mitigate this severe threat.
What’s new on HivePro
Get through updates and upcoming events, and more directly in your inbox