Hackers Weaponize Langflow Vulnerability to Launch Flodrix Botnet

A critical security flaw in Langflow, a Python-based AI prototyping framework, is being exploited by cybercriminals to deploy the Flodrix botnet.

Security researchers have confirmed that attackers are exploiting CVE-2025-3248, a remote code execution (RCE) vulnerability rated 9.8 on the CVSS scale, to compromise unpatched Langflow servers. This allows the botnet to launch distributed denial-of-service (DDoS) attacks and exfiltrate sensitive data.

Langflow, with significant popularity on GitHub, is used for building intelligent automation systems. Versions before 1.3.0 contain a critical flaw in the /api/v1/validate/code endpoint. This endpoint, intended to validate user-submitted Python code, lacks authentication and input validation. Consequently, attackers can send malicious POST requests embedding harmful code within function decorators or default arguments, allowing remote code execution.

The vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog on May 5, 2025, highlighting its severity.

Threat actors scan the internet for vulnerable Langflow instances using tools like Shodan. They utilize a proof-of-concept exploit to achieve remote shell access, execute reconnaissance commands, and deploy a downloader script to install the Flodrix malware. Flodrix communicates with its command-and-control infrastructure over TCP and the Tor network.

Flodrix is highly evasive, self-deleting after execution unless specific parameters are met. It removes forensic artifacts and uses XOR-based string obfuscation to hide command-and-control addresses. The malware checks for hidden files to avoid reinfecting the same host and forks child processes with fake names.

Flodrix, a descendant of the LeetHozer malware family, includes enhanced stealth and attack features:

Launches multiple types of DDoS attacks (e.g., tcpraw, udpplain). Performs extensive reconnaissance and terminates suspicious processes. Sends “KILLDETAIL” notifications to its command-and-control infrastructure. Uses encrypted configurations and supports new, obfuscated DDoS attack types.

Organizations using Langflow versions before 1.3.0 are at critical risk, especially if accessible from public networks. Recommended actions include:

Upgrading Langflow to version 1.3.0 or later, introducing strict authentication on the vulnerable endpoint. Restricting public access to Langflow endpoints. Monitoring for indicators of compromise linked to the Flodrix botnet.

Security vendors have updated detection rules to block exploitation attempts. Rapid patching remains essential as the botnet continues to evolve and target new victims.

Based on reporting by GBHackers.