EXPOSECHECK

Only run against servers you own or are authorized to test.

Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, or compromise verdict.

A small defensive self-check for the Langflow exposure associated with CVE-2025-3248. Give EXPOSECHECK one base URL—your own server or localhost—and it reports:

• whether the server returns an HTTP response;
• whether /api/v1/validate/code challenges an unauthenticated request;
• whether the detected Langflow version is older than the patched 1.3.0 threshold; and
• whether the entered host looks local/private or publicly addressable.

This is not an exploit or a mass scanner. It accepts one target, sends no executable code, and performs no internet-wide discovery. The validation-endpoint probe submits only an empty JSON object ({}).

Why this exists

Sysdig Threat Research documented JADEPUFFER, which its researchers believe to be the first ransomware attack run start-to-finish by an AI agent. Initial access was linked to the known, patched Langflow vulnerability CVE-2025-3248: older exposed instances allowed unauthenticated access to a code-validation endpoint.

Langflow is a legitimate open-source AI application framework. The risk is an exposed, unpatched deployment—not Langflow itself. Langflow 1.3.0+ contains the relevant fix and requires authentication on the endpoint.

CLI (recommended)

Requires Node.js 18+; there are no packages to install.

node check.js http://localhost:7860

You can also print machine-readable output:

node check.js http://localhost:7860 --json

Exit codes are useful in local scripts:

• 0 — PATCHED FOR CVE-2025-3248
• 1 — EXPOSED
• 2 — NEEDS ATTENTION, invalid input, or an inconclusive check

PATCHED FOR CVE-2025-3248 requires both a 401/403 auth challenge and a detected version of 1.3.0 or newer. It does not mean the server is generally safe. An endpoint that reaches request validation without an auth challenge is EXPOSED. Missing, redirected, blocked, or ambiguous responses are intentionally reported as NEEDS ATTENTION, not guessed safe.

Browser UI

Open index.html directly, or serve the directory locally:

python3 -m http.server 8080

Then visit http://localhost:8080.

Browsers enforce CORS and mixed-content rules. A cross-origin server may be healthy but still block the page from reading its response. That produces an inconclusive result; use the CLI for the reliable check.

Tests

Run the built-in regression suite with Node.js 18+:

node --test test.js

The suite locks the public result vocabulary so the CVE-scoped patched state cannot silently regress into a general safe or you're fine claim.

Local demo mode

The demos are deterministic and do not contact an external server.

CLI:

node check.js --demo exposed
node check.js --demo patched

Browser: use Demo: exposed and Demo: patched above the verdict panel. The page loads the exposed demo by default, which makes screen recording reliable without aiming the tool at a live target.

What the checks mean

The network hint only inspects the entered URL. It does not resolve DNS or prove that a host is reachable from the internet.

Green styling is scoped to the displayed predicate only. In particular, PATCHED FOR CVE-2025-3248 does not mean SAFE.

Remediation

Upgrade Langflow to 1.3.0+, put it behind authentication, and take it off the public internet.

Defense in depth still matters: restrict ingress, avoid placing development tools directly on the public internet, rotate credentials if exposure is suspected, and review server logs. If this tool reports an older version behind auth, it returns NEEDS ATTENTION because the software should still be patched.

Safety properties

• one user-supplied base URL at a time;
• no target lists, search-engine integration, or discovery;
• no exploit payload and no executable code sent;
• no authentication bypass attempt;
• no secrets collected or stored;
• short request timeout and small response read limit in the CLI.

Credits

• Sysdig JADEPUFFER research
• NVD: CVE-2025-3248
• Langflow

License

MIT. See LICENSE.