Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
97 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields (id, createdDate, chatId) by including them in the request body. The endpoint uses Object.assign() to copy all properties from the request body to the Lead entity without any input validation or field filtering. This allows attackers to bypass auto-generated fields and inject arbitrary values. | Field | Value | |-------|-------| | Vulnerability Type | Mass Assignment | | CWE ID | CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes | | Authentication Required | None | | Affected Endpoint | POST /api/v1/leads | --- Details Root Cause The vulnerability exists in /packages/server/src/services/leads/index.ts at lines 27-28: The Object.assign(newLead, body) on line 28 copies ALL properties from the request body to the Lead entity, including: - id - The primary key (should be auto-generated) - createdDate - The creation…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Description --- Vulnerability Overview - The /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELISTURLS, allowing unauthenticated access to the file upload API. - While the server validates uploads based on the MIME types defined in chatbotConfig.fullFileUpload.allowedUploadFileTypes, it implicitly trusts the client-provided Content-Type header (file.mimetype) without verifying the file's actual content (magic bytes) or extension (file.originalname). - Consequently, an attacker can bypass this restriction by spoofing the Content-Type as a permitted type (e.g., application/pdf) while uploading malicious scripts or arbitrary files. Once uploaded via addArrayFilesToStorage, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE). Vulnerable…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/ authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privileges. Details The global middleware that guards /api/v1 routes lives in external/Flowise/packages/server/src/index.ts:214. After filtering out the whitelist, the logic short-circuits on the spoofable header: Because the middle branch blindly calls verifyToken, any tenant that already has a UI session cookie is treated as an internal client simply by adding that header. No additional permission checks are performed before next() executes, so every downstream router under /api/v1 becomes reachable. PoC 1. Log into Flowise 3.0.8 and capture cookies (e.g., curl -c /tmp/flowisecookies.txt … /api/v1/auth/login). 2. Invoke an…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /api/v1/account/forgot-password endpoint returns the full user object including PII (id, name, email, status, timestamps) in the response body instead of a generic success message. This exposes sensitive user information to unauthenticated attackers who only need to know a valid email address. Vulnerability Details | Field | Value | |-------|-------| | CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | | Affected File | packages/server/src/enterprise/services/account.service.ts (lines 517-545) | | Endpoint | POST /api/v1/account/forgot-password | | Authentication | None required | | CVSS 3.1 | 3.7 (Low) | Root Cause In account.service.ts, the forgotPassword method returns the sanitized user object instead of a simple success acknowledgment: The sanitizeUser function only removes sensitive authentication fields: Impact An unauthenticated attacker can: 1. Harvest PII: Collect user IDs, full names, and account metadata 2. Profile users: Determine…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The default bcrypt salt rounds is set to 5, which is below the recommended minimum for security. Affected Code Evidence Using 5 salt rounds provides 2^5 = 32 iterations, which is far below the OWASP recommendation of 10 (2^10 = 1024 iterations) for bcrypt. This makes password hashes vulnerable to brute-force attacks with modern hardware. Impact Faster password cracking - in the event of database compromise, attackers can crack password hashes significantly faster than with proper salt rounds, potentially compromising all user accounts. Recommendation Increase default PASSWORDSALTHASHROUNDS to at least 10 (recommended by OWASP). Consider using 12 for better security-performance balance. Document that higher values increase login time but improve security. Notes The default bcrypt salt rounds is 5 (line 6), which provides only 2^5=32 iterations. OWASP recommends minimum 10 rounds (1024 iterations) for bcrypt. While configurable via PASSWORDSALTHASHROUNDS env var, the…
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure to Invalidate Existing Sessions After Password Change (Persistent Session / Session Invalidity Failure). Details After a user changes their password, the application does not invalidate other active sessions or session tokens that were established before the change. An attacker who already has an active session (e.g., via a stolen session token, device left logged in, or other access) continues to be authenticated even after the legitimate user rotates credentials, allowing the attacker to retain access despite the user’s password change. PoC Repro steps: 1. As logged in user on two browsers (ie. Chrome and Firefox, with incognito/private mode) https://cloud.flowiseai.com/account change password, on the Chrome for example 2. Refresh the site on Firefox (second browser) - notice that still logged in (despite credentials were changed) POC: Steps described above (in Repro steps) completed successfully. Impact Persistent unauthorized access despite credential rotation -…
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. NOTE: This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 and should be considered distinct from that identifier.
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution. Details Flowise supports providing ReadFileTool for large models to read files in the server's file system. The implementation of this tool is located at packages/components/nodes/tools/ReadFile/ReadFile.ts. The tool directly uses the filepath parameter passed to it without verifying whether the path belongs to Flowise's working directory. Authenticated attackers can exploit this vulnerability to read any known file on the server. For example, if the victim deploys in a Docker environment, the attacker could attempt to read sensitive files such as /root/.flowise/encryption.key, /root/.flowise/database.sqlite, and obtain sensitive information. If the victim does not use a Docker environment for deployment, the attacker could try reading sensitive files like…
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A file upload vulnerability in FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). Details The system fails to validate file extensions, MIME types, or file content during uploads. As a result, malicious scripts such as Node.js-based web shells can be uploaded and stored persistently on the server. These shells expose HTTP endpoints capable of executing arbitrary commands if triggered. The uploaded shell does not automatically execute, but its presence allows future exploitation via administrator error or chained vulnerabilities. Taint Flow - Taint 01: Route Registration POST file requests are routed to the controller via Multer https://github.com/FlowiseAI/Flowise/blob/d29db16bfcf9a4be8febc3d19d52263e8c3d0055/packages/server/src/routes/attachments/index.ts#L8 - Taint 02: Multer Settings Uploaded…
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive information with stored Cross Site Scripting. PoC If the above HTML code is entered, a very large img gets injected into the log. When an admin clicks the generated img, it alerts ‘XSS!!!’. It means stored xss is able in the chatbot. So when an admin clicks the img that generated by above html code, it sends a request, including credentials, to the attacker's IP. If attacker steal admin’s token, attacker can login as the admin in the apps. Poc Video poc Impact An attacker could hijack an admin account in published chatbot. This can allow attacker to view chat logs of other users and API keys.
Recommended action: Upgrade to 3.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-Site Scripting (XSS) vulnerability in FlowiseAI allows a user to inject arbitrary JavaScript code via message input. When an administrator views messages using the "View Messages" button in the workflow UI, the malicious script executes in the context of the admin’s browser, enabling credential theft via access to localStorage. --- Details The vulnerability stems from a lack of input sanitization when displaying stored user messages in the admin interface. A specially crafted payload using <iframe srcdoc="..." can include arbitrary JavaScript, which is executed when the message is rendered. --- PoC 1. Deploy a FlowiseAI agent and make it accessible via browser (e.g., embed on a website). 2. Send the following payload via the agent's chat interface: 3. As an admin, go to the workflow and click "View Messages". 4. The JavaScript is executed in the admin's browser, exfiltrating localStorage content to the attacker-controlled webhook endpoint. --- Impact - Type:…
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A XSS(cross-site scripting) vulnerability is caused by insufficient filtering of input by web applications. Attackers can leverage this XSS vulnerability to inject malicious script code (HTML code or client-side Javascript code) into web pages, and when users browse these web pages, the malicious code will be executed, and the victims may be vulnerable to various attacks such as cookie data theft, etc. Details 1. Send a Message <iframe src="javascript:alert(document.cookie);" from User in a chat box: <img width="1396" alt="image" src="https://github.com/user-attachments/assets/b472e304-9e7a-40d2-8469-675a5f0744e5" / Trigger in other ways: 2. Create a Agentflow in cloud platform (https://cloud.flowiseai.com/agentflows) 3. Create a Custom function as an example, use the below example code. 4. The external website (https://external.website) return a XSS payload as content. <img width="1228" alt="image"…
Recommended action: Upgrade to 3.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, the default installation of Flowise operates without authentication unless explicitly configured using the `FLOWISE_USERNAME` and `FLOWISE_PASSWORD` environment variables. This combination presents a significant security risk, potentially allowing users on the platform to execute unsandboxed system commands. This can result in Remote Code Execution (RCE) and complete compromise of the running platform container or server. PoC 1. Follow the provided instructions for running the app using Docker Compose (or other methods of your choosing such as `npx`, `pnpm`, etc): https://github.com/FlowiseAI/Flowise?tab=readme-ov-file#-docker 2. Create a new file named `payload.json` somewhere in your machine, with the…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing chat flow id validation allows an attacker to access arbitrary file. Details Commit https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f and https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7 added check for `filename` when handling file upload operations to prevent path traversal, and additional validation of `chatflowId` and `chatId` from route `/api/v1/attachments`. In some cases, however, `chatflowId` and `chatId` are not validated to ensure they are UUIDs or numbers, which may lead to security issues. Case 1 When creating new chatflow via `/api/v1/chatflows`, function `addBase64FilesToStorage` is called if there exists base64 file data. Although the `filename` is sanitized, the `chatflowid` comes from request body directly without any validation. An attacker could exploit the path traversal here to write arbitrary file with controlled data. ```typescript export const…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file read vulnerability in the chatId parameter supplied to both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows reading of the local sqlite db and subsequent compromise of all database content. Details Both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints accept the chatId parameter and pass this to a subsequent call to streamStorageFile(). While streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId. There is validation that the resulting filePath is restricted to the /root/.flowise/storage directory. However, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted. As this fallback path is read after the /root/.flowise/storage check,…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cause of the Vulnerability The CustomMCP node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as childprocess and fs. Vulnerability Flow 1. User Input Received: Input is provided via the API endpoint /api/v1/node-load-method/customMCP through the mcpServerConfig parameter. 2. Variable Substitution: The substituteVariablesInString function replaces template variables like $vars.xxx, but no security filtering is applied during this step. 3. Dangerous Code…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
--- A Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. The impact includes the potential exposure of sensitive internal administrative endpoints. Details --- Vulnerability Overview The fetch-links feature in Flowise is designed to extract links from external websites or XML sitemaps. It performs an HTTP request from the server to the user-supplied URL and parses the response (HTML or XML) to extract and return links. The issue arises because the feature performs these HTTP requests without validating the user-supplied URL. In particular, when the relativeLinksMethod parameter is set to webCrawl or xmlScrape, the server directly calls the fetch() function with the provided URL, making it vulnerable to SSRF attacks. Root Cause The fetch() function is…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated admin user of FlowiseAI can exploit the Supabase RPC Filter component to execute arbitrary server-side code without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's execSync() to launch reverse shells, access environment secrets, or perform any OS-level command execution. This results in full server compromise and severe breach of trust boundaries between frontend input and backend execution logic. Details FlowiseAI includes a component called Supabase.ts, located at: packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237 <img width="622" height="177" alt="image(3)" src="https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b" / This creates a function from user-provided string supabaseRPCFilter with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed immediately when the node is triggered.…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (cloud.flowiseai.com) and self-hosted/local Flowise deployments that expose the same API. CVSS v3.1 Base Score: 9.8 (Critical) Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H --- Details The endpoint /api/v1/account/forgot-password accepts an email address as input. Instead of only sending a reset email, the API responds directly with sensitive user details, including: User ID, name, email, hashed credential, status, timestamps. A valid tempToken and its expiry, which is intended for password reset. This tempToken can then be reused immediately in the /api/v1/account/reset-password endpoint to reset the password…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability. While this feature is intentional, it should have strong protections added and be disabled by default. These issues include: 1. Remote code execution. While inside a sandbox this allows for 1. Sandbox escape 2. DoS by crashing the server 3. SSRF 2. Prompt Injection, both System and User 1. Full control over LLM prompts 2. Server variable and data exfiltration And many many more such as altering the flow of a conversation, prompt exfiltration via LLM proxying etc. These issues are self-targeted and do not persist to other users but do leave the server and business exposed. All issues are shown with the API but also work with the web embed. Workarounds - overrideConfig should be disabled by…
Recommended action: Upgrade to 2.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
Recommended action: Upgrade to 2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.