Article Details
Scrape Timestamp (UTC): 2025-05-06 04:30:53.375
Source: https://thehackernews.com/2025/05/critical-langflow-flaw-added-to-cisa.html
Original Article Text
Click to Toggle View
Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence. A recently disclosed critical security flaw impacting the open-source Langflow platform has been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-3248, carries a CVSS score of 9.8 out of a maximum of 10.0. "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests," CISA said. Specifically, the endpoint has been found to improperly invoke Python's built-in exec() function on user-supplied code without adequate authentication or sandboxing, thereby allowing attackers to execute arbitrary commands on the server. The shortcoming, which affects most versions of the popular tool, has been addressed in version 1.3.0 released on March 31, 2025. Horizon3.ai has been credited with discovering and reporting the flaw in February. According to the company, the vulnerability is "easily exploitable" and allows unauthenticated remote attackers to take control of Langflow servers. A proof-of-concept (PoC) exploit has since been made publicly available as of April 9, 2025, by other researchers. Data from attack surface management platform Censys shows that there are 466 internet-exposed Langflow instances, with a majority of them concentrated in the United States, Germany, Singapore, India, and China. It's currently not known how the vulnerability is being abused in real-world attacks, by whom, and for what purpose. Federal Civilian Executive Branch (FCEB) agencies have time until May 26, 2025, to apply the fixes. "CVE-2025-3248 highlights the risks of executing dynamic code without secure authentication and sandboxing measures," Zscaler noted last month. "This vulnerability serves as a critical reminder for organizations to approach code-validation features with caution, particularly in applications exposed to the internet."
Daily Brief Summary
Critical security flaw in Langflow platform, CVE-2025-3248, now in the CISA's Known Exploited Vulnerabilities catalog due to active exploitation evidence.
The flaw possesses a high severity score of 9.8 and enables remote, unauthenticated attackers to execute arbitrary code through the /api/v1/validate/code endpoint.
Attack methodology involves misuse of Python’s exec() function without proper authentication or security measures in place, facilitating remote command execution on affected servers.
While the vulnerability impacts multiple versions of Langflow, a fix has been provided in the latest version 1.3.0, released on March 31, 2025.
Researchers at Horizon3.ai discovered and reported the vulnerability; it is deemed "easily exploitable" and potentially allows full server control.
A proof-of-concept for the exploit was made public on April 9, 2025, increasing the urgency for patch implementations.
Over 400 internet-exposed instances of Langflow have been identified, predominantly in the US, Germany, Singapore, India, and China.
CISA mandates Federal Civilian Executive Branch agencies to patch the vulnerability by May 26, 2025, underlining the critical nature of the flaw.