CVE-2025-3248: listed in the CISA KEV catalog CVE-2025-3248 · CVSS 9.8 CRITICAL · EPSS 100.0% · KEV 2025-05-05
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.
Is CVE-2025-3248 exploited? Listed in the CISA KEV catalog on 2025-05-05. Federal remediation due 2025-05-26. Past that date by 446 days. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-3248 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.
CVE-2025-3248: listed in the CISA KEV catalog CVE-2025-3248 · CVSS 9.8 CRITICAL · EPSS 100.0% · KEV 2025-05-05
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.
Is CVE-2025-3248 exploited? Listed in the CISA KEV catalog on 2025-05-05. Federal remediation due 2025-05-26. Past that date by 446 days. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-3248 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.