Langflow < 1.3.0 Unauthenticated Code Injection RCE (CVE-2025-3248) (Direct Check)

Language:

Version 1.5 Oct 30, 2026, 8:32 AM Logic Changes (improved socket handling in get_tls_server_response for TLS 1.3) Plugin Feed: 202610300832
Version 1.4 Oct 15, 2026, 8:27 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610150827
Version 1.2 Aug 14, 2026, 5:17 PM CISA reference CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202608141717
Version 1.1 Aug 12, 2026, 1:09 AM New Plugin Feed: 202608120109

* Changelogs are generally available for changes made after Nov 1, 2022