CVE

CVE-2025-3248

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

Exploitation IoCs 3

Domain api.groq[.]com

Domain helloxcherry[.]com

Filename Secure Document CA-283505.pdf.lnk

MITRE ATT&CK TTPs 1

T1059.001

PowerShell

Execution

Source Articles

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

A new modular malware framework dubbed Avalon has been discovered, capable of executing a multi-stage attack chain that includes credential theft, lateral movement, and ransomware deployment via its CrownX component. The attack begins with a phishing email containing a password-protected archive hosted on Proton Drive, which delivers a malicious ISO image. The framework employs advanced defense evasion techniques, disables recovery mechanisms, and exfiltrates sensitive data before encrypting systems. Notably, Avalon shows signs of AI-assisted development, lowering the barrier for less sophisticated actors to deploy complex malware.

hacker-news Jul 3, 2026