Skip to content
OpenAdvisories

Product · FlowiseAI

flowise-components

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-41271

    Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the …

    FlowiseAI Flowise flowise-components flowise npm
  • High 7.1
    CVE-2026-41272

    Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These…

    FlowiseAI Flowise flowise-components flowise npm
  • High 7.1
    CVE-2026-41270

    Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protecti…

    FlowiseAI Flowise flowise-components flowise npm