Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE Exploit Scanner CVE-2025-3248 This Python-based scanner automates the detection of unauthenticated Remote Code Execution RCE vulnerabilities in Langflow instances via CVE-2025-3248. It uses a proof-of-concept payload that abuses the /api/v1/validate/code endpoint to execute...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 Langflow RCE PoC ★ Lab Setup root@kitploit: docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 Description Langflow versions prior to 1.3.0 are susceptible to code injection in the...

Mass-CVE-2025-3248

Langflow CVE-2025-3248 Exploit Tool Overview This tool exploits the critical Remote Code Execution RCE vulnerability CVE-2025-3248 found in Langflow versions prior to 1.3.0. The vulnerability exists in the /api/v1/validate/code endpoint which improperly executes user-supplied code without...

CVE-2025-3248

CVE-2025-3248: Langflow Unauthenticated Remote Code Execution RCE This repository contains two Python scripts: LangflowCheck.py: A scanner that checks for Langflow AI instances vulnerable to CVE-2025-3248. exploit.py: A working reverse shell exploit for vulnerable Langflow targets. Summary...

CVE-2025-3248

POC - दूरस्थ और बिना प्रमाणीकरण वाला हमलावर मनमाना कोड निष्पादित करने के लिए क्राफ्टेड HTTP अनुरोध भेज सकता है - CVE-2025-3248 अवलोकन Langflow के 1.3.0 से पहले के संस्करण /api/v1/validate/code एंडपॉइंट में कोड इंजेक्शन के प्रति संवेदनशील हैं। एक दूरस्थ और बिना प्रमाणीकरण वाला हमलावर मनमाना कोड...

CVE-2024-48061

CVE-2024-48061 Langflow vulnerable to remote code execution CVE-2024-48061 poc Usage root@kitploit: python3 poc.py -i -p -l -lp Description This script exploits a vulnerable API endpoint at /api/v1/validate/code on the target web server. It first verifies the presence of the vulnerable path, then...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...

CVE-2025-3248

CVE-2025-3248 परिचय 1.3.0 से पहले के Langflow संस्करण /api/v1/validate/code एंडपॉइंट में Python exec फ़ंक्शन के माध्यम से बिना प्रमाणीकरण के कोड इंजेक्शन के प्रति संवेदनशील हैं। यह एक्सप्लॉइट इस कमज़ोरी का दुरुपयोग करके एक रिवर्स शेल कनेक्शन स्थापित करता है। उपयोग कॉन्फ़िगरेशन root@kitploit: git...

CVE-2026-0770

🚀 CVE-2026-0770 – Langflow RCE execglobal PoC Remote Code Execution vulnerability in Langflow 📌 Affected Software This vulnerability affects: Langflow 🧠 Vulnerability Overview CVE-2026-0770 is a Remote Code Execution RCE vulnerability in the: root@kitploit: /api/v1/validate/code endpoint. When...

CVE-2025-3248-Langflow-RCE

mitsec - CVE-2025-3248 Langflow RCE Exploit Remote Code Execution RCE exploit for Langflow applications vulnerable to CVE-2025-3248. Affected Endpoint: /api/v1/validate/code 🚀 Exploit Features Remote and unauthenticated RCE No authentication required Python3 one-liner script Colorized terminal...

CVE-2025-3248

CVE-2025-3248 — Langflow RCE शोषण CVE-2025-3248 के प्रति संवेदनशील Langflow अनुप्रयोगों के लिए रिमोट कोड निष्पादन RCE शोषण। प्रभावित एंडपॉइंट: /api/v1/validate/code 🚀 शोषण विशेषताएँ 🔓 रिमोट और बिना प्रमाणीकरण वाला RCE 🔐 कोई प्रमाणीकरण आवश्यक नहीं 🐍 Python3 वन-लाइनर स्क्रिप्ट 🎨 स्पष्टता के लिए रंग...

CVE-2025-3248

CVE-2025-3248 Langflow is a low-code platform primarily used for building and deploying AI agents and workflows. It simplifies the development process by providing a visual interface for creating complex AI applications, including chatbots, RAG Retrieval-Augmented Generation systems, and more...

CVE-2025-3248-POC

Langflow RCE Exploit - CVE-2025-3248 ⚠️ Disclaimer This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving...

CVE-2025-3248

CVE-2025-3248 ★ CVE-2025-3248 Langflow RCE PoC ★ प्रयोगशाला सेटअप root@kitploit: docker pull langflowai/langflow:1.2.0 docker run -d --name CVE-2025-3248 -p 7860:7860 langflowai/langflow:1.2.0 localhost:7860 विवरण Langflow के 1.3.0 से पहले के संस्करण /api/v1/validate/code एंडपॉइंट पर कोड इंजेक्शन...

CVE-2026-0770

CVE-2026-0770 Overview This tool is used to test the vulnerability CVE-2026-0770 in the Langflow application. It leverages the /api/v1/validate/code endpoint to perform Remote Code Execution RCE. Developer: Ohang Thanks to: @C4p333 Purpose: Security Research & Educational Use Installation Termux...

CVE-2025-3248

CVE-2025-3248 — Langflow AI Remote Code Execution Unauthenticated Author: 0xgh057r3c0n Description This exploit targets a critical unauthenticated RCE vulnerability CVE-2025-3248 in Langflow AI. The vulnerability allows an attacker to execute arbitrary system commands on the target server via the...

Langflow validate/code exec() Remote Code Execution (CVE-2026-0770) (Direct Check)

Binary data langflowvalidatecodercecve20260770.nbin...

Langflow 1.x.x < 1.10.1 Code Injection

The version of Langflow installed on the remote host is 1.x.x prior to 1.10.1. It is, therefore, affected by a code injection vulnerability: - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with...

CVE-2026-8481

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...