A critical remote code execution vulnerability in the open-source Langflow platform has been actively exploited by threat actors. Discovered by Horizon3.ai in April 2025, the flaw, tracked as CVE-2025-3248 (CVSS 9.8/10), stems from the /api/v1/validate/code endpoint, which improperly used Python’s exec() function to run user-supplied code without authentication or sandboxing. Attackers have leveraged Python features, such as function decorators and default arguments, to bypass validation and gain full control of vulnerable servers, enabling remote shell access and sensitive data exfiltration. Although intended to offer flexibility in building Agentic AI workflows, this design inadvertently created a severe security gap. A public proof-of-concept (PoC) exploit was released on April 9, 2025, and exploit attempts have already been observed against honeypots. Censys identified 1,156 internet-exposed Langflow servers, with hundreds potentially vulnerable. On May 5, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies patch the flaw by no later than May 26, 2025. Langflow addressed the issue in version 1.3.0 (released March 31, 2025) by adding authentication to the endpoint, and CTIX analysts strongly urge any administrators to update or restrict network access to mitigate risks.