[CVE-2025-3248] Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI
Summary
CVE-2025-3248 is a critical code injection vulnerability affecting Langflow, a popular tool used for building out agentic AI workflows. This vulnerability is easily exploitable and enables unauthenticated remote attackers to fully compromise Langflow servers. The issue is patched in Langflow 1.3.0.
- CVE
- CVE-2025-3248
- Published
- Collected
--- id: 10199 title: "[CVE-2025-3248] Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI" cve: CVE-2025-3248 source_domain: horizon3.ai source_url: "https://horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/" published_at: "2025-04-09T17:44:35Z" tags: ["ai-security", "rce", "vulnerability-research"] phying_url: "https://phying.com/item/10199" lang: en --- # [CVE-2025-3248] Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI ## Summary CVE-2025-3248 is a critical code injection vulnerability affecting Langflow, a popular tool used for building out agentic AI workflows. This vulnerability is easily exploitable and enables unauthenticated remote attackers to fully compromise Langflow servers. The issue is patched in Langflow 1.3.0. ## Intelligence Metadata - **Sources:** horizon3.ai - **CVE:** CVE-2025-3248 - **Published:** 2025-04-09T17:44:35Z - **Original:** https://horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/ - **Phying News:** https://phying.com/item/10199