Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
30 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Faiss and SimpleStore (LlamaIndex) vector store implementations accept a basePath parameter from user-controlled input and pass it directly to filesystem write operations without any sanitization. An authenticated attacker can exploit this to write vector store data to arbitrary locations on the server filesystem. Vulnerability Details | Field | Value | |-------|-------| | Affected File | packages/components/nodes/vectorstores/Faiss/Faiss.ts (lines 79, 91) | | Affected File | packages/components/nodes/vectorstores/SimpleStore/SimpleStore.ts (lines 83-104) | Prerequisites 1. Authentication: Valid API token with documentStores:upsert-config permission 2. Document Store: An existing Document Store with at least one processed chunk 3. Embedding Credentials: Valid embedding provider credentials (e.g., OpenAI API key) Root Cause Faiss (Faiss.ts) SimpleStore (SimpleStore.ts) Impact An authenticated attacker can: 1. Write files to arbitrary locations on the server filesystem 2.…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. Details The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. https://github.com/FlowiseAI/Flowise/blob/d848baeb6bd9737a1e7fc912349c45fbdcc7bb38/packages/components/nodes/tools/MCP/core.ts#L223…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. Impact includes: - Access to internal admin panels (e.g., internal company dashboards, Jenkins, Kubernetes API, etc.). - Retrieval of cloud provider metadata (e.g., AWS IMDSv1 at [http://169.254.169.254], GCP, Azure). - Port scanning and enumeration of internal services. - Potential lateral movement or privilege escalation in compromised environments. This vulnerability is particularly severe because: - Flowise instances are often deployed publicly without authentication…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution. Details Flowise supports providing ReadFileTool for large models to read files in the server's file system. The implementation of this tool is located at packages/components/nodes/tools/ReadFile/ReadFile.ts. The tool directly uses the filepath parameter passed to it without verifying whether the path belongs to Flowise's working directory. Authenticated attackers can exploit this vulnerability to read any known file on the server. For example, if the victim deploys in a Docker environment, the attacker could attempt to read sensitive files such as /root/.flowise/encryption.key, /root/.flowise/database.sqlite, and obtain sensitive information. If the victim does not use a Docker environment for deployment, the attacker could try reading sensitive files like…
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores.
Recommended action: Upgrade to 2.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.