Langflow Missing Authentication Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 05/05/2025. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| langflow | < 1.3.0 | 1.3.0 |
| langflow-base | < 0.3.0 | 0.3.0 |
| langflow | < 1.3.0 | 1.3.0 |
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free