## https://sploitus.com/exploit?id=7B38C660-C8D9-5B2F-A413-FC49E2560D10
# CVE-2025-3248 Langflow RCE Scanner
## 🔍 Description
A powerful, unauthenticated RCE scanner for CVE-2025-3248 in vulnerable Langflow instances.
- **CVE**: 2025-3248
- **Type**: Remote Code Execution (Unauthenticated)
- **Affected**: Langflow < 1.3.0
- **Author**: Issam Junior ([@issamiso](https://t.me/issamiso))
---
## 💥 Vulnerability Overview
Langflow's `/api/v1/validate/code` endpoint insecurely executes user-supplied code using Python `exec()`, without authentication or sandboxing. This enables remote attackers to execute arbitrary Python code.
---
## ✅ Protection
- Upgrade to Langflow **1.3.0 or newer**
- Block access to `/api/v1/validate/code`
- Use proper code sandboxing (e.g., Pyodide, Docker, restricted ASTs)
---
## ⚙️ Usage
```bash
git clone https://github.com/issamjr/CVE-2025-3248-Scanner.git
cd CVE-2025-3248-Scanner
pip install -r requirements.txt
python3 scanner.py --url http://example.com/
python3 scanner.py --list targets.txt
```
---
## 🔐 Disclaimer
This tool is for **authorized security research** only. Misuse is prohibited.
---
## 🛠️ Contact
Developer: **Issam Junior**
Telegram: [@issamiso](https://t.me/issamiso)
GitHub: [github.com/issamjr](https://github.com/issamjr)