Langflow Unauthenticated Code Injection Exploit Attempt
Langflow, an open-source tool for building AI workflows, has an endpoint that compiles and executes submitted Python code without requiring login. Attackers exploit this to run their own code on the server by hiding it inside Python constructs that execute at definition time, like decorators or default arguments.
How the attack works
An unauthenticated attacker sends a POST request to a Langflow code endpoint such as /api/v1/validate/code or /api/v1/custom_component, or targets a publicly exposed flow via /api/v1/build, /api/v1/run, /api/v1/flows, or /api/v1/mcp. Because the endpoint only executes statements evaluated at module-definition time, the malicious payload is smuggled inside a decorator, a function default argument, a base class expression, or a metaclass expression rather than a plain statement. When Langflow compiles and execs the submitted module, that hidden payload runs. The same attack can arrive either as a direct HTTP request or via a process on the agent's host shelling out to curl, python, or httpie to hit the endpoint with a crafted JSON code field.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f3b2a1c7-8d4e-4a6b-9c25-7e1d0f4a9b83
- Severity
- High
- CVEs
- CVE-2025-3248
Why it matters
An attacker gets arbitrary code execution on the Langflow server without needing credentials, which can lead to full compromise of the host running the AI workflow platform and anything it can reach.
What you can do
- →Do not expose Langflow's code-evaluation or flow-build endpoints to the public internet; restrict them to trusted internal networks or require authentication in front of them.
- →Review any publicly accessible flows (access_type=PUBLIC) and remove public access unless explicitly required.
- →Audit custom components and validated code for decorators, default arguments, base classes, or metaclass expressions that call subprocess, os, or similar - these are the exploit's telltale shape.
- →Patch or upgrade Langflow to a version that fixes CVE-2025-3248, and monitor logs for POSTs to /api/v1/validate/code, /api/v1/custom_component, /api/v1/build, /api/v1/run, /api/v1/flows, or /api/v1/mcp carrying suspicious code payloads.
Known benign look-alikes
- Langflow developer saving or validating a custom component that genuinely wraps a decorator or default argument around subprocess/os - rare, because these shapes are Python anti-patterns, but possible in hand-rolled shell-runner components.
- Authorised vulnerability scanning or red-team validation of an internal Langflow instance (nuclei template, Metasploit module, manual curl PoC for CVE-2025-3248).
- CI/CD regression tests that replay the exploit payload against a disposable Langflow test instance to verify the patch.
- An operator pasting a public proof of concept into a shell one-liner while researching the advisory rather than attacking a production host.