CVE-2025-3248 Langflow /api/v1/validate/code RCE with Base64 Python Payload

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•5

Detects attempts to exploit an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing Base64 encoded payloads or direct Python command-line execution patterns, which indicate an attempt to achieve arbitrary code execution.