Skip to content
OpenAdvisories
Critical WID-SEC-2025-2105 3 CVEs

Flowise: Mehrere Schwachstellen

Published Sep 22, 2025 · Updated Sep 22, 2025 · de-DE

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um Informationen offenzulegen und beliebigen Code auszuführen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 3

  • Critical 10.0
    CVE-2025-59528 Public exploit Scanner template EPSS 92%

    Flowise has Remote Code Execution vulnerability

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server…

    FlowiseAI Flowise flowise npm
  • Critical 9.6
    CVE-2025-59434

    Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from…

    FlowiseAI Flowise
  • High 7.5
    CVE-2025-59527

    FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability all…

    FlowiseAI Flowise flowise npm

Revision history

  1. #1

    Initiale Fassung

References