Flowise CVE-2025-50538

Exploitation requires (1) a Flowise instance whose chat/agent interface is reachable by the attacker (e.g. embedded on a website or otherwise publicly accessible) so an unauthenticated user can submit chat messages, and (2) an administrator subsequently opening the stored conversation via the 'View Messages' button in the workflow UI, which renders unsanitized message data through dangerouslySetInnerHTML. The specific trigger is an HTML payload such as <iframe srcdoc="<script>...</script>"> stored as a chat message. Limiting factors: the attack is not self-executing - it depends on admin user interaction (UI:R) to fire, and impact centers on theft of whatever is in the admin's browser localStorage (session tokens/credentials). No attacker authentication is required (PR:N). Affected versions are Flowise prior to the patched release (cited as 3.0.5 by the release reference; GHSA also cites 3.0.8 - confirm before remediation).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) describes a classic stored XSS: network-reachable, low complexity, no privileges for the attacker (an anonymous end user of the chatbot injects the payload), but requiring user interaction (an admin must open 'View Messages'). The GHSA advisory confirms this is STORED XSS with a concrete credential-theft impact (localStorage exfiltration → potential admin account takeover), which arguably justifies confidentiality/integrity higher than the C:L/I:L used by the CVSS provider. The most notable signal is the EPSS score of 14.04% at the 96th percentile - very high for a medium-severity XSS - combined with publicly available exploit code (the GHSA advisory includes a working iframe srcdoc PoC) and an available vendor patch. This is NOT a high-CVSS-but-low-real-risk case; the reverse applies - a moderate 6.1 base score understates operational risk because the exploit is public, trivially weaponizable, and the payoff (admin panel/session compromise) is high. It is NOT on CISA KEV, so there is no confirmed active exploitation; the elevated EPSS plus public PoC indicate opportunistic exploitation is plausible rather than proven. Note a data conflict to verify: the description and release reference cite 'before 3.0.5', while the GHSA text lists 'affected < 2.2.7' and separately 'vulnerable < 3.0.8 / fixed in 3.0.8' - confirm the actual patched release (PR #4905 landed the DOMPurify/SafeHTML fix).

An attacker interacts with a publicly exposed Flowise chatbot/agent and sends a chat message containing an <iframe srcdoc="..."> payload with embedded JavaScript (no authentication needed to chat). The message is stored; when an administrator later opens the conversation via the 'View Messages' button in the workflow UI, the script executes in the admin's browser context, exfiltrating localStorage (session tokens/credentials) to an attacker-controlled webhook. A working PoC is published in the GHSA advisory, and CVSS UI:R confirms the attack hinges on the admin viewing the log.