mirror of
https://github.com/gobysec/GobyVuls.git
synced 2025-05-05 10:16:59 +00:00
15 lines
1.2 KiB
Markdown
15 lines
1.2 KiB
Markdown
|
**Updated document date: April 9, 2025**
|
|||
|
|
|
|||
|
|
## Langflow /api/v1/validate/code Code Execution Vulnerability (CVE-2025-3248)
|
|||
|
|
| **Vulnerability** | Langflow /api/v1/validate/code Code Execution Vulnerability (CVE-2025-3248)|
|
|||
|
|
| :----: | :-----|
|
|||
|
|
| **Chinese name** | Langflow /api/v1/validate/code 代码执行漏洞（CVE-2025-3248） |
|
|||
|
|
| **CVSS core** | 7.80 |
|
|||
|
|
| **FOFA Query** (click to view the results directly)| [product="LOGSPACE-LangFlow"]
|
|||
|
|
| **Number of assets affected** | 2448 |
|
|||
|
|
| **Description** |LangFlow is a low-code visual AI application development tool based on Python, focusing on the development of Multi-Agent AI, Prompt Engineering, and Retrieval-Augmented Generation (RAG) applications. Versions prior to 1.3.0 are vulnerable to code injection in the /api/v1/validate/code endpoint. Remote and unauthenticated attackers can send crafted HTTP requests to execute arbitrary code.|
|
|||
|
|
| **Impact** | Versions prior to 1.3.0 are vulnerable to code injection in the /api/v1/validate/code endpoint. Remote and unauthenticated attackers can send crafted HTTP requests to execute arbitrary code, potentially leading to full server control.|
|
|||
|
|
| **Affected versions** | <1.3.0
|
|||
|
|
|
|||
|
|
|