Skip to content
OpenAdvisories

Vendor

FlowiseAI

120 known vulnerabilities.

Products

Flowise 119 flowise-components 7 FlowiseChatEmbed 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.7
    CVE-2026-67620 Public exploit

    Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

    Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoin…

    FlowiseAI Flowise
  • High 8.7
    CVE-2026-69263 Public exploit

    Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYL…

    FlowiseAI Flowise flowise flowise-components npm
  • High 7.7
    CVE-2026-30824 Public exploit Scanner template EPSS 37%

    Flowise: Missing Authentication on NVIDIA NIM Endpoints

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privilege…

    FlowiseAI Flowise flowise npm
  • High 7.5
    CVE-2024-36420 Public exploit Scanner template

    GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName…

    FlowiseAI Flowise flowise npm