Flowise CVE-2025-29192

Requires a Flowise instance running a published/reachable chatbot where an unauthenticated user can submit prompts that are stored in the chat log. The specific trigger is that the log renderer allowed <form> and <input> elements and inserted message data via dangerouslySetInnerHTML without sanitization, so a payload using <input type="image"> with a javascript: formaction is persisted. Exploitation is LIMITED by required privileged-victim interaction: an administrator must open the chat-log viewer (ViewMessagesDialog) AND, per the PoC, click the injected oversized image to fire the formaction - it is not fully automatic on view. The high-value outcome (admin credential/token theft from localStorage → account takeover) depends on the admin having those secrets in browser storage. Fixed in 3.0.5, which sanitizes log HTML with DOMPurify.

This is a stored (persistent) cross-site scripting flaw (CWE-79) rated medium at CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent: network-reachable, low complexity, no attacker privileges (PR:N - an unauthenticated user can submit chatbot prompts), but it DOES require victim interaction (UI:R - an admin must open and, per the PoC, click the injected element), and the scope change (S:C) reflects that the payload executes in the admin's browser context rather than the injection point. The limited C:L/I:L / A:N impacts match a classic XSS, though the practical consequence the vendor describes - theft of the admin's stored token/password from localStorage leading to full admin account takeover and access to other users' chat logs and API keys - is materially more serious than the low sub-scores suggest. Exploitation status: publicly available exploit code exists (a working PoC and demo video are published in the GHSA advisory); this is NOT confirmed active exploitation - there is no CISA KEV listing. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. On balance this is a real, credibly exploitable issue with a public PoC and a clear high-value outcome (admin takeover), tempered by the requirement that a privileged admin view and interact with the malicious log entry - so it is a solid patch-soon priority rather than an emergency.

An attacker interacts with a publicly published Flowise chatbot and submits a prompt containing a crafted HTML <form> wrapping an <input type="image"> whose formaction is a javascript: URI; this is persisted verbatim in the chat log. When an administrator later opens the chat-log viewer (ViewMessagesDialog) and clicks the oversized injected image, the JavaScript runs in the admin's authenticated session and exfiltrates the admin's credentials/token from localStorage to an attacker-controlled server, enabling admin account takeover. A public PoC, payload, and demo video are published in the GHSA-7r4h-vmj9-wg42 advisory.