Langflow CVE-2025-3248 Unauthenticated Code Validation RCE Attempt

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•9

This rule detects incoming HTTP POST requests to the '/api/v1/validate/code' endpoint of a Langflow instance. The rule specifically looks for a JSON key 'code' containing a large, potentially base64-encoded string, which indicates an attempt to exploit CVE-2025-3248 to achieve unauthenticated remote code execution.