EUVD-2026-25286
GHSA-rh7v-6w34-w2rr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Authenticated Chatflow-edit access gives PR:L over the network with low complexity; a successful Node.js web shell yields full command execution, so C/I/A all High.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). This vulnerability is fixed in 3.1.0.
AnalysisAI
Malicious file upload leading to potential remote code execution in FlowiseAI Flowise before 3.1.0 lets an authenticated attacker bypass MIME-type restrictions in the Chatflow file-upload configuration to add the application/javascript type and store .js Node.js web shells on the server. Publicly available exploit code exists (working web shell and Python upload script published in the GHSA advisory), though EPSS remains very low at 0.06% (19th percentile). This is a bypass of the earlier fix for CVE-2025-61687 (GHSA-35g6-rrw3-v6xc), indicating incomplete prior remediation.
Technical ContextAI
Flowise is a Node.js drag-and-drop application for building large language model flows. The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the createAttachment path and Chatflow configuration file-upload settings do not properly validate MIME types server-side. Although the web UI does not present JavaScript as a selectable upload type, an attacker can edit the Chatflow configuration to inject the application/javascript MIME type, after which the backend accepts .js files. Because Flowise runs on Node.js, an uploaded .js file can be a functional web shell (the PoC spawns child_process.exec via an HTTP listener), turning a file-write primitive into command execution within the server process context. The affected CPE is cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade Flowise to version 3.1.0 or later, which corrects the MIME-type validation in the Chatflow file-upload settings; this is the primary and complete fix per GHSA-rh7v-6w34-w2rr (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-rh7v-6w34-w2rr). If immediate upgrade is not possible, apply compensating controls: restrict who can create or modify Chatflow configurations to trusted administrators only (this removes the PR:L primitive but reduces multi-user collaboration), place the Flowise instance behind authentication and off the public internet, and add an upload/egress filter or reverse-proxy rule that rejects .js and application/javascript uploads to the attachment endpoints (trade-off: may break legitimate flows that rely on script assets). Because this is a bypass of the earlier CVE-2025-61687 fix, verify the running version is genuinely 3.1.0 rather than an intermediate build, and monitor the upload directory for unexpected .js files and unexpected outbound listeners (e.g., the PoC's port 8888).
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today