FlowiseAI

8 results · Clear filters · Feed

• High 7.7
  CVE-2026-67620 Public exploit

  Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

  Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoin…

  FlowiseAI Flowise
  Aug 8, 2026
• High 8.7
  CVE-2026-69263 Public exploit

  Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYL…

  FlowiseAI Flowise flowise flowise-components npm
  Aug 4, 2026
• Critical 9.4
  CVE-2026-69254 Public exploit

  Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.…

  FlowiseAI Flowise flowise flowise-components npm
  Aug 4, 2026
• Critical 9.2
  CVE-2026-41264 Public exploit

  Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the CSV_Agents class. The issue results from the lack of proper sandboxing when evaluating an LLM genera…

  FlowiseAI Flowise flowise flowise-components npm
  Apr 23, 2026
• High 7.7
  CVE-2026-30824 Public exploit Scanner template EPSS 37%

  Flowise: Missing Authentication on NVIDIA NIM Endpoints

  Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privilege…

  FlowiseAI Flowise flowise npm
  Mar 7, 2026
• Critical 10.0
  CVE-2025-59528 Public exploit Scanner template EPSS 87%

  Flowise has Remote Code Execution vulnerability

  Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server…

  FlowiseAI Flowise flowise npm
  Sep 22, 2025
• Critical 9.8
  CVE-2025-58434 Public exploit Scanner template EPSS 83%

  Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

  Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication …

  FlowiseAI Flowise flowise npm
  Sep 12, 2025
• High 7.5
  CVE-2024-36420 Public exploit Scanner template

  GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file

  Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName…

  FlowiseAI Flowise flowise npm
  Jul 1, 2024