CVE-2025-3248 affects langflow-ai's langflow product in versions before 1.3.0. The vulnerability arises from the lack of authentication on the /api/v1/validate/code endpoint, enabling remote attackers without any privileges to execute arbitrary code by sending specially crafted HTTP requests. This represents a critical security flaw that compromises confidentiality, integrity, and availability of the affected system.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the vulnerable system, leading to full compromise including potential data theft, system manipulation, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at a high level as reflected by the CVSS score of 9.8.

A fixed version 1.3.0 or later should be applied to remediate this vulnerability. Since no official patch links are provided, users should upgrade to langflow version 1.3.0 or above where this issue is resolved. Until then, restricting access to the /api/v1/validate/code endpoint and implementing authentication controls may reduce exposure. Patch status is not yet confirmed by vendor advisory; check the vendor's official channels for updates.