Skip to content
OpenAdvisories

Package · npm

flowise-components

31 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-56273

    Flowise - Path Traversal in Vector Store basePath Parameter

    Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary f…

    Flowise Flowise flowise flowise-components npm
  • Medium 6.0
    CVE-2026-56275

    Flowise - Server-Side Request Forgery via Execute Flow Base URL

    Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal…

    Flowise Flowise flowise flowise-components npm
  • Medium 5.3
    CVE-2026-43995

    Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1…

    FlowiseAI Flowise flowise flowise-components npm