Langflow versions prior to 1.3.0 contain a critical remote code execution vulnerability in the /api/v1/validate/code endpoint. This flaw allows unauthenticated attackers to send crafted HTTP requests that execute arbitrary code on the affected system. The vulnerability is identified as CVE-2025-3248 and has a CVSS 4.0 base score of 9.3, indicating a critical severity. Fixed versions 1.3.0 and 0.3.0 are available. Public exploit code exists, including Metasploit and Exploit-DB modules, and detection templates are available via Nuclei. No known exploitation in the wild has been reported.