GHSA-c995-4fw3-j39m: Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint
This advisory was withdrawn on Jun 17, 2025. The publisher no longer considers it a valid vulnerability.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references. Original Description Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Published Apr 7, 2025 · Updated Jun 17, 2025
Affected packages
langflow
- Ecosystem
- PyPI
- Affected
- < 1.3.0
- Fixed in
- 1.3.0
- Check
pip show langflow
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references.
Original Description
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-3248
- https://github.com/langflow-ai/langflow/pull/6911
- https://github.com/langflow-ai/langflow/releases/tag/1.3.0
- https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai
- https://github.com/advisories/GHSA-c995-4fw3-j39m
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Langflow vulnerabilities
All Langflow entriesCVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
critical9.9Oct 7, 2026CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
medium5.4Oct 7, 2026CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
high7.1Oct 7, 2026CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
high7.1Oct 7, 2026CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
critical9.9Oct 6, 2026GHSA-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
medium6.3Oct 6, 2026