CVSS: 10.0EPSS: 80%CPEs: 1EXPL: 6CVE-2025-3248 – Langflow Unauth RCE
https://notcve.org/view.php?id=CVE-2025-3248
07 Apr 2025 — Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. • https://packetstorm.news/files/id/190465 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 1CVE-2024-37014
https://notcve.org/view.php?id=CVE-2024-37014
10 Jun 2024 — Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script. Langflow hasta la versión 0.6.19 permite la ejecución remota de código si los usuarios que no son de confianza pueden acceder al endpoint "POST /api/v1/custom_component" y proporcionar un script de Python. • https://github.com/langflow-ai/langflow/issues/1973 • CWE-94: Improper Control of Generation of Code ('Code Injection') •