High · 8.2 CVE-2025-29192 EUVD-2025-32213GHSA-7r4h-vmj9-wg42GHSA-wq95-wr7m-26h4

Flowise Stored XSS vulnerability through logs in chatbot

Published Oct 6, 2025 · Updated Oct 6, 2025 · Assigned by mitre

Vendor: FlowiseAI Product: Flowise Package: flowise Ecosystem: npm

Description

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

Affected products

Vendor	Product	Affected	Fixed
FlowiseAI	Flowise	< 3.0.5	3.0.5

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	flowise	< 3.0.5	3.0.5	GHSA-7r4h-vmj9-wg42

Advisories 1

WID-SEC-2025-2197 Flowise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Oct 5, 2025

References