Description
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | ≤ 2.2.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | <= 2.2.7 | — | GHSA-9c4c-g95m-c8cp |
Advisories 1
- WID-SEC-2025-0717 Flowise: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 24, 2026
References
- GitHub Security Advisory (GHSA-9c4c-g95m-c8cp) vendor-advisory
- VulnCheck Advisory: Flowise - SQL Injection in importChatflows API via chatflow.id Parameter third-party-advisory