Back Securityaffairs.Co

Attackers exploit critical Flowise flaw CVE-2025

Securityaffairs.Co •Pierluigi Paganini • April 7, 2026

Attackers are exploiting a critical Flowise flaw, tracked as CVE-2025-59528 (CVSS score of 10), that lets them run malicious code and access systems due to poor validation of user-supplied JavaScript. Attackers are actively exploiting a critical vulnerability in Flowise, tracked as CVE-2025-59528, that allows remote code execution and file system access. The flaw stems from improper validation […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Langflow RCE Vulnerability Exploited Within 20 Hours A critical vulnerability in Langflow, tracked as CVE-2026-33017, allows unauthenticated remote code execution (RCE) via the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint. This flaw was exploited within 20 hours of its disclosure on March 20, 2026, with the first successful data exfiltration occurring shortly after 25 hours. Attackers can send crafted HTTP requests containing arbitrary Python code that executes server-side without sandboxing. The vulnerability affects users of Langflow, a popular open-source framework for building AI workflows, which has over 145,000 stars on GitHub. Sysdig reported that attackers are leveraging this vulnerability to pivot into connected AI pipelines, potentially harvesting sensitive API keys and database credentials. The CVSS score for this vulnerability is 9.3, indicating its critical nature. The issue was patched in version 1.9.0 of Langflow. No public exploits were reported prior to the vulnerability's disclosure, but exploitation attempts were quickly observed. Organizations using Langflow are at risk of significant data loss and system compromise. 17 sources 73

Extracted Entities

Attackers exploit critical Flowise flaw CVE-2025

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)