Skip to content
OpenAdvisories
Critical WID-SEC-2025-1836 2 CVEs

Flowise: Mehrere Schwachstellen ermöglichen Codeausführung

Published Aug 13, 2025 · Updated Aug 14, 2025 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode oder Kommandos auszuführen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-55346 EPSS 25%

    Unintended dynamic code execution leads to remote code execution by network attackers

    User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

    flowise npm
  • Critical 9.8
    CVE-2025-8943 Public exploit Scanner template EPSS 75%

    Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

    The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermo…

    flowise npm

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-24801, GHSA-Q4XX-MC3Q-23X8, GHSA-2VV2-3X8X-4GV7, EUVD-2025-24803

  2. #1

    Initiale Fassung

References