Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Langflow Unauth RCE

Exploited · CISA KEVFix availableCritical · CVSS 9.3EPSS 100.0%

Published Jun 17, 2025 · updated Oct 27, 2026 · added to CISA KEV May 5, 2025

What to do

  1. Upgrade to a fixed version: langflow 1.3.0, langflow-base 0.3.0.
  2. This is exploited in the wild: treat it as urgent (CISA's federal deadline is May 26, 2025).
  3. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIlangflow8,617 downloads/week

Vulnerable versions
< 1.3.0
Fixed in
1.3.0

Check your project: pip show langflow

PyPIlangflow-base7,678 downloads/week

Vulnerable versions
< 0.3.0
Fixed in
0.3.0

Check your project: pip show langflow-base

What changed

  1. May 5, 2025

    Added to CISA KEV on 2025-05-05: exploitation in the wild confirmed; federal remediation due 2025-05-26.

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection')

← All critical vulnerabilities