A critical vulnerability in Langflow discovered in December 2025 is now under active exploitation. Users and administrators are advised to update to the latest version immediately.
Langflow, a platform for building and deploying AI-powered agents and workflows released security updates in December 2025 addressing a critical vulnerability (CVE-2025-34291) in its product.
This vulnerability has a Common Vulnerability Scoring System (CVSS v4.0) score of 9.4 out of 10.
Successful exploitation of this origin validation error vulnerability could allow an unauthenticated remote attacker to execute arbitrary code and achieve full system compromise.
This vulnerability is being actively exploited in the wild.
The vulnerability affects Langflow versions 1.6.9 and prior.
Users and administrators of affected versions are advised to update to the latest version immediately.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
