Skip to content
OpenAdvisories

Package · npm

flowise

114 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-69263 Public exploit

    Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYL…

    FlowiseAI Flowise flowise flowise-components npm
  • High 7.7
    CVE-2026-30824 Public exploit EPSS 37%

    Flowise: Missing Authentication on NVIDIA NIM Endpoints

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privilege…

    FlowiseAI Flowise flowise npm
  • High 7.5
    CVE-2024-36420 Public exploit

    GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName…

    FlowiseAI Flowise flowise npm
  • High 7.6
    CVE-2024-31621 Public exploit EPSS 60%

    Flowise vulnerable to code injection via api/v1

    An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

    flowise npm