Description
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascript:alert(document.cookie)">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.0.8 | 3.0.8 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.0.8 | 3.0.8 | GHSA-4fr9-3x69-36wv |
References
- GitHub Security Advisory (GHSA-4fr9-3x69-36wv) vendor-advisory
- VulnCheck Advisory: Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows third-party-advisory