Langflow CVE-2025-3248 Unauthenticated RCE via /api/v1/validate/code

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects an attempt to exploit CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies POST requests to the '/api/v1/validate/code' endpoint that contain base64 encoded strings in the request body, which are characteristic of malicious Python payloads designed to execute arbitrary code.