Flowise

Incomplete credential redaction in Flowise before 3.1.3 exposes fully decrypted secrets via the authenticated GET /api/v1/credentials/:id endpoint, allowing any user with credentials:view permission to retrieve database connection URLs containing embedded passwords, Google Cloud service account JSON files with RSA private keys, and AWS access keys in plaintext. The root cause is a server-side redaction function that only masks schema fields declared with type 'password', leaving string-typed fields - routinely used for sensitive credential values - untouched in the plainDataObj API response. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege, network-accessible nature of this flaw makes it an immediate priority for any organization running shared or multi-user Flowise workspaces.

Flowise before 3.1.4 exposes stored third-party API credentials (OpenAI, ElevenLabs) through a missing authorization check in the unauthenticated text-to-speech endpoint, enabling financial abuse at the chatflow owner's expense. The `/api/v1/text-to-speech/generate` endpoint is whitelisted from authentication and fetches any chatflow by UUID without verifying its `isPublic` status, allowing any network-reachable attacker with a valid chatflow UUID to generate unlimited TTS audio billed to the victim. A public proof-of-concept is included in the GHSA advisory; no CISA KEV listing exists at time of analysis.

Remote code execution in Flowise before 3.1.3 lets authenticated users escape the vm2 JavaScript sandbox and run arbitrary code on the host. By abusing a moment.js locale-validation weakness, an attacker supplies a forged String object whose match function defeats the path-traversal check, causing Flowise to load and execute an attacker-planted JavaScript file from the document store outside the sandbox. Reported by VulnCheck and fixed by the vendor; no public exploit or CISA KEV listing was identified at time of analysis, though the CVSS 4.0 base score of 9.0 reflects full compromise of confidentiality, integrity, and availability.

Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTOCOL is set to stdio - to run arbitrary OS commands on the host. By manipulating environment variables (PYTHONWARNINGS, BROWSER) passed to python3 or leveraging node with the root working directory, an attacker bypasses input validation and achieves command execution as the Flowise service account. Reported by VulnCheck with a CVSS 4.0 score of 9.0; no public exploit is identified at time of analysis, though the technique is documented in detail in the vendor advisory.

Flowise's cloud billing API exposes a broken access control flaw at the GET /api/v1/organization/customer-default-source endpoint, enabling any authenticated user to retrieve payment and profile data belonging to arbitrary other customers by manipulating the customerId query parameter. Versions up to and including 3.1.2 are affected; the server authenticates the session but performs no ownership check on the requested customer object, returning full Stripe customer records - including email, balance, currency, and invoice metadata - for any valid customerId supplied. A proof-of-concept is publicly documented in GitHub security advisory GHSA-2364-jh4q-m9vm, and the predictable Stripe-format customer ID scheme (cus_XXX) makes systematic enumeration practical for any registered user.

Remote code execution and SSRF in FlowiseAI Flowise before 3.1.3 stems from a bypassable regex-based Python code validator in the CSV and Airtable Agent nodes, letting attackers smuggle malicious pandas calls through the unauthenticated prediction API via prompt injection. Because the validator blocklists rather than sandboxes, unblocked functions such as pd.read_json() can be abused to exfiltrate local datasets, reach internal services (SSRF), or execute arbitrary code. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the reporting vendor VulnCheck and a GitHub Security Advisory (GHSA-w7x8-q2gp-5cgg) document the issue.

Authenticated arbitrary Python code execution in FlowiseAI Flowise before 3.1.3 arises from the CSV Agent node's customReadCSV parameter, whose regex-based validator can be defeated with obfuscation to run attacker-supplied code inside an unsandboxed pyodide runtime with full host access. Any user able to build or edit a chatflow can escalate from application-level access to code execution on the server. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch exists in version 3.1.3.

Remote code execution in Flowise before 3.1.3 lets attackers run arbitrary Python on the host by abusing the Airtable Agent node. Crafted chatflow prompts carry obfuscated Python that slips past the pythonCodeValidator blocklist and executes inside an unsandboxed pyodide runtime with full access to the underlying OS. Reported by VulnCheck with a published GHSA advisory; no public exploit code is identified at time of analysis, and it is not listed in CISA KEV.

Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. A successful attacker can exfiltrate uploaded CSV data or write arbitrary files to the server filesystem; no public exploit has been identified at time of analysis, but the attack primitives are fully documented in the advisory.

Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScript sandbox by abusing the /api/v1/node-custom-function endpoint. By passing attacker-controlled executablePath and args into puppeteer.launch(), the code reaches child_process.spawn() outside the sandbox, yielding arbitrary OS command execution as the Flowise process user (root in the official Docker image) and host file disclosure via Chromium's file:// handling. No public exploit is identified at time of analysis, but a vendor security advisory (GHSA-9gvv-qjj3-2p6g) and VulnCheck confirm the flaw; the CVSS 4.0 base score is 9.4.

Unauthenticated file exfiltration in Flowise 2.2.4-3.1.4 is possible because the POST /api/v1/openai-assistants-file/download endpoint was incorrectly added to the application's global authentication whitelist, causing all session and API key verification to be skipped unconditionally. Any remote, unauthenticated attacker who can supply valid chatflowId, chatId, and fileName identifiers can retrieve private files from any chatflow on the instance, including those belonging to other workspaces or organizations in a multi-tenant deployment. A public proof-of-concept exploit is available via GitHub, and no KEV listing has been confirmed at time of analysis.

Cross-tenant billing manipulation in Flowise's enterprise API allows any authenticated user to perform unauthorized Stripe subscription operations against other organizations by supplying an arbitrary victim subscriptionId to the /update-subscription-plan and /update-additional-seats endpoints. All Flowise enterprise deployments running versions prior to 3.1.3 are affected, with impact including unauthorized plan downgrades, seat-count inflation (inflating victim billing), and service disruption across tenants. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability is mechanically straightforward given knowledge of a target organization's Stripe subscription identifier.

Missing authorization middleware on the PUT /api/v1/executions/:id endpoint in Flowise prior to 3.1.3 allows any authenticated workspace member, regardless of assigned RBAC role, to overwrite execution state, data, and metadata for any workflow execution in their workspace. The flaw is a straightforward RBAC enforcement gap - the checkAnyPermission() middleware present on all sibling GET and DELETE routes was omitted from the PUT handler - making privilege escalation trivially reproducible with a single authenticated API call. No confirmed active exploitation (not in CISA KEV), but a working proof-of-concept curl command is published in the vendor's GitHub security advisory, and a vendor-released patch is available in version 3.1.3.

Cross-workspace OAuth2 credential isolation failure in Flowise prior to version 3.1.3 enables two distinct attack classes: authenticated users can initiate OAuth2 flows against credentials owned by other workspaces, and - more critically - unauthenticated attackers can forge OAuth2 callbacks to overwrite tokens or trigger token refreshes for any credential system-wide by exploiting a whitelist that bypasses all authentication on the /callback and /refresh endpoints. The root cause is that all three OAuth2 handlers query the Credential table by credential ID alone, omitting the workspaceId isolation enforced elsewhere in the codebase. No public exploit has been identified at time of analysis, and the issue is fixed in Flowise 3.1.3.

Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDataFrame) can be defeated with Unicode homoglyph identifiers, letting an attacker run arbitrary Python that escapes the Pyodide sandbox and executes OS commands on the Flowise host with the process's privileges. The affected CSV Agent and Airtable Agent nodes gate LLM-generated (and config-supplied) Python through an ASCII word-boundary regex blacklist, which Python's NFKC identifier normalization silently rewrites back into the forbidden dunders. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the GitHub advisory documents a complete, reproducible bypass technique, so weaponization is straightforward; the vendor rates it 9.5 (CVSS 4.0).

Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.

Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.

Flowise's DELETE /api/v1/chatflows/:id endpoint fails to enforce RBAC boundaries between flow resource types, allowing authenticated workspace members to delete flows they are not permitted to manage. Users holding only agentflows:delete can permanently destroy CHATFLOW resources, and users holding only chatflows:delete can destroy AGENTFLOW resources, in the same workspace. All Flowise installations prior to 3.1.3 are affected; no public standalone exploit tool exists, but the GHSA advisory (GHSA-p5w8-m249-4r4v) supplies a verbatim curl reproduction demonstrating the issue with minimal effort.

Authentication bypass in Flowise 3.0.13 and earlier lets remote unauthenticated attackers forge valid JWTs and impersonate any user, including administrators, because the enterprise passport authentication middleware silently falls back to publicly known hardcoded secrets ('auth_token', 'refresh_token') and default audience/issuer values ('AUDIENCE', 'ISSUER') whenever the JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER environment variables are unset. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it grants full account takeover, though there is no public exploit identified at time of analysis and no CISA KEV listing.

Authentication bypass in Flowise 3.0.13 and earlier lets unauthenticated remote attackers forge valid signed session cookies and impersonate any user, including administrators. The flaw stems from a publicly known hardcoded default secret ('flowise') used by the express-session middleware whenever the EXPRESS_SESSION_SECRET environment variable is left unset - the default deployment state. No public exploit identified at time of analysis, but forgery is trivial since the signing key is visible in the source code, and CVSS 4.0 rates it 9.3 (Critical).

Cross-origin request forgery via a hardcoded CORS wildcard in Flowise's text-to-speech endpoint (versions before 3.1.2) allows any malicious webpage to trigger TTS generation using a victim's stored credentials. The controller file `packages/server/src/controllers/text-to-speech/index.ts` unconditionally sets `Access-Control-Allow-Origin: *`, directly overriding the server's restrictive `getCorsOptions()` CORS policy for that route. No public exploit is identified at time of analysis, but the attack requires only basic web scripting skill given the straightforward CORS bypass mechanism.

Arbitrary code execution in Flowise before 3.1.3 on Windows allows an authenticated user with Custom MCP node configuration access to bypass the NODE_OPTIONS environment variable denylist by supplying the lowercase variant 'node_options', exploiting a case-sensitive string comparison against a case-insensitive OS. The injected NODE_OPTIONS --require directive causes the Flowise server process to load an attacker-controlled module when spawning a Custom MCP stdio child process. A publicly available proof-of-concept exists per VulnCheck; the vulnerability is not listed in CISA KEV, and exploitation is constrained by Windows platform dependency and the requirement for stdio mode to be explicitly enabled.

Arbitrary file write leading to remote code execution in FlowiseAI Flowise (versions <= 2.2.7) lets unauthenticated remote attackers overwrite any file on the host via the /api/v1/document-store/loader/process endpoint. The fileName parameter is passed unsanitized into path.join() inside storageUtils.ts, so ../ sequences escape the storage directory; overwriting package.json injects a malicious start script that executes on the next application restart. Publicly available exploit code exists (vendor GHSA PoC overwriting package.json), and the issue carries a CVSS 4.0 base score of 10.0; no public active-exploitation listing was identified at time of analysis.

Remote code execution in Flowise (versions 2.2.7-patch.1 through pre-3.0.6) lets attackers run arbitrary OS commands by abusing the Custom MCP feature, which is intended to spawn local MCP servers via tools like npx. Because the default installation runs with no authentication (unless FLOWISE_USERNAME/FLOWISE_PASSWORD are set) and lacks role-based access control, an attacker can POST a crafted JSON payload bearing the 'x-request-from: internal' header to /api/v1/node-load-method/customMCP and fully compromise the host container. Publicly available exploit code exists in the GHSA advisory, including a reverse-shell payload via nc.

Persistent session hijacking in Flowise 3.0.7 and earlier (fixed in 3.0.10) lets an attacker retain authenticated access to a victim's account even after the victim changes their password, because the application never invalidates pre-existing sessions or session tokens on credential rotation (CWE-613). Anyone holding a stolen token or a device left logged in keeps full access, defeating the primary remediation users rely on after a suspected compromise. A working proof-of-concept is published in the vendor's GHSA advisory; publicly available exploit code exists, but there is no public exploit identified as actively exploited in the wild and it is not on the CISA KEV list.

Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers traverse the filesystem because the chatflowId and chatId parameters are never validated as UUIDs or numbers. By supplying a path-traversal value such as '../../../../../tmp' as the chatflow id, an attacker can write controlled files via the /api/v1/chatflows endpoint and read arbitrary files via /api/v1/get-upload-file and /api/v1/openai-assistants-file/download - and the file-write primitive can be escalated to remote code execution. A proof-of-concept is published in the GHSA advisory, though there is no public exploit identified as actively used in the wild and the issue is not listed in CISA KEV.

Unauthenticated arbitrary file upload in Flowise (versions through 2.2.7) lets remote attackers write malicious files to arbitrary locations on the server via the whitelisted /api/v1/attachments endpoint when storageType is set to local (the default). Because the chatId and chatflowId parameters are vulnerable to path traversal, an attacker can escape the intended upload directory and drop a webshell or other executable payload, leading to remote code execution and full server compromise. No public exploit identified at time of analysis, but the flaw is trivially reachable (CVSS 4.0 9.3) and was reported by VulnCheck with a vendor security advisory.

Account takeover in Flowise (the open-source low-code LLM application builder) before version 3.0.10 stems from the account settings Security section accepting a password change without requiring the current password or any re-verification. Any authenticated user - or an attacker who hijacks or coerces an existing authenticated session - can silently reset the account credential and seize full control of the account. Publicly available exploit code exists (documented PoC with repro steps and screenshot in the GitHub Security Advisory GHSA-fjh6-8679-9pch), but there is no public exploit identified as actively exploited and it is not listed in CISA KEV.

Authentication bypass in Flowise on-premise (npm package 'flowise', version 3.0.1 and earlier) lets unauthenticated remote attackers POST to the /api/v1/account/register endpoint to self-provision arbitrary user accounts and then log in, obtaining full API access without any prior credentials. The endpoint is open by default and the registration request is reusable, so an attacker can repeatedly create privileged ('type':'pro') accounts. A working proof-of-concept exists (publicly available exploit code exists via the VulnCheck/GHSA advisory), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact.

Unauthenticated arbitrary file read in Flowise before 3.0.6 lets remote attackers traverse outside the storage directory via the unvalidated chatId parameter on the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, reading sensitive files such as /root/.flowise/database.sqlite and dumping the entire application database in default deployments. The flaw was reported by VulnCheck with a vendor security advisory (GHSA-99pg-hqvx-r4gf), and while no public exploit was identified at time of analysis, the root cause and code path are fully documented in the advisory, lowering the barrier to weaponization. CVSS 4.0 base score is 8.7 (High), reflecting network-reachable, no-authentication, no-interaction exploitation with high confidentiality impact.

Flowise versions up to and including 3.0.12 hash passwords using bcrypt with a default cost factor of 5 rounds - yielding only 32 iterations versus the OWASP-recommended minimum of 1,024 at 10 rounds - making stored password hashes approximately 30 times faster to crack with modern GPU hardware. All deployments where the PASSWORD_SALT_HASH_ROUNDS environment variable has not been manually overridden to 10 or higher are affected, which represents the majority of real-world installs since defaults predominate. In a database breach scenario, an attacker who obtains the hash table can leverage GPU-accelerated tools to recover plaintext passwords at roughly 300,000 attempts per second versus ~10,000 at the recommended work factor; no public exploit identified at time of analysis.

Unauthenticated OAuth secret disclosure in FlowiseAI Flowise versions 3.0.13 and earlier allows remote attackers to harvest cleartext SSO client secrets for Google, Microsoft/Azure, GitHub, and Auth0 by sending a single GET request to /api/v1/loginmethod with a guessable organizationId. Affects both FlowiseAI Cloud and self-hosted deployments where the endpoint is reachable; publicly available exploit code exists (vendor GHSA includes a complete request/response PoC), and the leaked credentials enable downstream identity-provider compromise.

Flowise versions 3.0.13 and earlier silently fall back to a hardcoded AES-256-CBC encryption key derived from the publicly known literal 'Secre$t' when TOKEN_HASH_SECRET is not configured, exposing the user and workspace IDs encoded in the 'meta' field of every JWT token issued by an unconfigured deployment. An authenticated user or network-positioned attacker who obtains any valid JWT can decrypt this metadata using the default key - now disclosed in the GHSA advisory and source code - and re-encrypt manipulated identifiers to probe downstream access controls. JWT signature validation is handled independently, so this does not constitute standalone token forgery, but identifier disclosure and metadata manipulation create a realistic stepping stone toward privilege escalation or unauthorized workspace access in multi-tenant deployments. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; vendor-released patch Flowise 3.1.0 is available.

SQL injection in Flowise through 2.2.7 allows authenticated users to execute arbitrary SQL via the importChatflows API by supplying a crafted JSON file whose chatflow.id value is concatenated unsanitized into an IN clause. Successful exploitation enables blind and error-based extraction of stored credentials and tampering with application data. Publicly available exploit code exists in the GHSA advisory, though no active exploitation is confirmed.

Server-side request forgery in Flowise's Execute Flow node allows authenticated low-privilege users to coerce the server into issuing HTTP requests to arbitrary internal network addresses by supplying intranet URLs through the base URL configuration field. All flowise and flowise-components npm versions through 3.0.13 are affected due to the Execute Flow code path never invoking the secureFetch wrapper present in httpSecurity.ts. Publicly available exploit code exists in GHSA-9hrv-gvrv-6gf2, including a concrete POST request demonstrating server-side retrieval and echo of internal service responses; no CISA KEV listing indicates active mass exploitation at time of analysis.

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update permissions) to abuse the Custom MCP Server feature and run arbitrary OS commands on the host. The validateCommandFlags blocklist and validateArgsForLocalFileAccess regex are incomplete - for example 'docker build' is permitted and 'npx --yes' is permitted while only '-y' is blocked - letting attackers point Flowise at a hostile Dockerfile or local script to achieve full host compromise. Publicly available exploit code exists (the GHSA advisory ships a reproduction), though there is no public exploit identified at time of analysis in CISA KEV.

Account takeover in Flowise versions 3.0.7 and earlier allows an authenticated user to change their account email address via the profile endpoint without re-authenticating or confirming the change to the original email. Because email serves as both login identifier and password-recovery channel, an attacker who has hijacked a session (e.g., via XSS, stolen token, or unattended workstation) can pivot to permanent account ownership. Publicly available exploit code exists in the GitHub Security Advisory with reproduction steps, but no public exploit identified as actively used in the wild.

Cross-workspace chatflow configuration disclosure in Flowise before 3.1.2 allows any holder of a valid API key for one workspace to read the full configuration of unprotected chatflows belonging to all other workspaces in the same instance. The `/api/v1/chatflows/apikey/:apikey` endpoint's database query omits a workspace scope filter when the `keyonly` parameter is absent (the default), causing it to return every chatflow system-wide where `apikeyid` is NULL or empty - including `flowData`, system prompts, `chatbotConfig`, `apiConfig`, and credential IDs from unrelated tenants. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially reproducible given the disclosed source code and standard HTTP tooling.

Path traversal in FlowiseAI Flowise's S3 Document Loader component (packages/components/nodes/documentloaders/S3/S3.ts) enables authenticated remote attackers to manipulate S3 object key inputs to access files outside the intended storage scope. Versions 3.1.0 through 3.1.2 are confirmed affected. Publicly available exploit code exists (E:P in the CVSS 4.0 vector), and the vendor did not respond to responsible disclosure, leaving no vendor-confirmed patch at time of analysis.

Mass assignment in Flowise's PUT /api/v1/user endpoint (all versions before 3.1.2) allows an authenticated user to overwrite their own account's password hash by supplying a crafted `credential` field in the request body, entirely bypassing the intended old-password verification, hashing enforcement, and session-invalidation workflow. An attacker who first obtains a temporary session - via XSS, token theft, or session hijacking - can exploit this to establish permanent account persistence even after the legitimate session expires, with no knowledge of the current password required. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.1.2.

Unauthenticated PII exposure in Flowise's forgot-password API endpoint allows remote attackers to harvest user objects containing IDs, full names, email addresses, account status, and timestamps by submitting any known or guessed email address. All Flowise releases prior to 3.0.13 are affected via the POST /api/v1/account/forgot-password endpoint, which returns a sanitized but data-rich user object instead of a generic acknowledgment. No public exploit has been identified at time of analysis per CISA KEV, though the GHSA advisory (GHSA-jc5m-wrp2-qq38) includes a working curl-based proof-of-concept demonstrating the full response.

Cross-site scripting in Flowise before 3.0.8 allows unauthenticated network attackers to inject malicious JavaScript into the chat interface via iframe javascript: URI payloads, or indirectly via custom agent functions that fetch and render unsanitized external HTTP responses. When a victim browses the affected chat or agent output in their browser, the injected script executes in their session, enabling cookie theft and session hijacking. A working proof-of-concept payload is publicly documented in GitHub Security Advisory GHSA-4fr9-3x69-36wv; no active exploitation is confirmed in CISA KEV at time of analysis.

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Information disclosure in FlowiseAI Flowise prior to version 3.1.2 allows authenticated users to retrieve encrypted credential blobs (API keys, passwords, OAuth tokens for OpenAI, AWS, etc.) by querying the credentials API with a credentialName filter. The /api/v1/credentials endpoint correctly strips the encryptedData field on unfiltered queries but omits this sanitization on the filtered code path, exposing AES-encrypted secrets to any authenticated caller. No public exploit identified at time of analysis, though a working curl reproduction is published in the GHSA advisory.

Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key to submit arbitrary JavaScript via POST /api/v1/node-custom-function, which executes inside a NodeVM sandbox that can be escaped to reach the host process and spawn child processes. CVSS 4.0 scores this 9.4 Critical, and publicly available exploit details exist via the GHSA advisory, though no public exploit identified at time of analysis in CISA KEV. The flaw stems from missing route-level authorization combined with a sandbox that Flowise itself documents as a security boundary but which fails to contain malicious payloads.

Cross-workspace tenant isolation bypass in FlowiseAI versions prior to 3.1.2 allows authenticated low-privileged users to reassign assistant resources to arbitrary workspaces by manipulating server-controlled fields in the assistant update endpoint. The flaw is a mass assignment issue (CWE-284) tracked as EUVD-2026-35109, with publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified at time of analysis as widely deployed exploitation. SSVC indicates total technical impact but non-automatable exploitation.

Credential brute-force exposure in Flowise prior to 3.1.2 allows remote unauthenticated attackers to perform unlimited password-guessing attacks against the checkBasicAuth endpoint, which lacks rate limiting and uses non-constant-time plaintext comparison against the FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables. Successful exploitation grants full access to the Flowise LLM workflow builder. No public exploit identified at time of analysis, though the GHSA advisory documents the vulnerable code path in detail and EPSS sits at a low 0.04%.

Flowise versions prior to 3.1.0 allow authenticated remote attackers to bypass SSRF protections by exploiting direct HTTP client imports in four tool implementations (OpenAPIToolkit, WebScraperTool, MCP, and Arxiv) that circumvent the centralized httpSecurity.ts validation wrapper. An attacker with tool access can craft requests to reach blocked internal endpoints such as AWS metadata services, restoring full SSRF capability despite administrative deny-list configuration.

FlowiseAI Flowise up to version 3.0.12 allows remote unauthenticated information disclosure through manipulation of the account verification endpoint. An attacker can exploit improper input validation in the verify function of the account service to extract sensitive information over the network. Publicly available exploit code exists, and the vendor has recommended upgrading to address this issue.

Authorization bypass in FlowiseAI Flowise up to version 3.0.12 allows authenticated users to manipulate userId, organizationId, workspaceId, and email parameters in the User Controller Handler, potentially gaining unauthorized access to other users' data or organizational resources. The vulnerability requires valid user authentication and remote network access, resulting in confidentiality impact with low attack complexity. No active exploitation in CISA KEV has been confirmed at time of analysis.

Information disclosure in FlowiseAI Flowise up to version 3.0.12 allows remote attackers to extract sensitive data through the Login function in the API Response Handler component. The vulnerability requires high attack complexity and is difficult to exploit, but successful exploitation results in confidentiality impact without authentication requirements. No public confirmation of active exploitation has been identified at time of analysis.

Cypher injection in Flowise GraphCypherQAChain node allows remote unauthenticated attackers to execute arbitrary database commands against connected Neo4j instances. Attackers can exfiltrate, modify, or delete data in the graph database by injecting malicious Cypher queries through user-controlled input fields that bypass sanitization (CWE-943: Improper Neutralization of Special Elements in Data Query Logic). The vulnerability affects both Flowise core and flowise-components packages prior to version 3.1.0. CVSS 9.3 critical severity reflects network-accessible attack vector requiring no authentication or user interaction. EPSS data unavailable; no CISA KEV listing indicates exploitation not yet confirmed in the wild, though GitHub security advisory confirms vendor awareness and patch availability.

Unauthenticated authorization-key abuse in FlowiseAI Flowise before 3.1.0 lets remote attackers invoke the whitelisted text-to-speech endpoint (POST /api/v1/text-to-speech/generate) with an attacker-supplied credentialId, causing the server to decrypt and use a victim's stored provider API key (OpenAI, ElevenLabs, Azure, Google) to generate speech at the victim's expense. The GitHub Security Advisory (GHSA-5fw2-mwhh-9947) includes Docker-based validation proving the code path executes without authentication, but there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is very low (0.04%, 12th percentile), consistent with SSVC exploitation status of 'none'.

Information disclosure in FlowiseAI Flowise before 3.1.0 exposes plaintext credentials through the unauthenticated GET /api/v1/public-chatflows/:id and public-chatbotConfig endpoints, which return the full raw flowData for any chatflow flagged public. Because the sanitizeFlowDataForPublicEndpoint helper is absent from the released v3.0.13 Docker image, remote attackers can retrieve credential IDs, plaintext API keys, and password-type fields without authentication. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but the disclosure is trivially automatable per CISA SSVC.

Cross-workspace object takeover in Flowise (versions prior to 3.1.0) lets authenticated low-privilege users overwrite DocumentStore records belonging to other workspaces. The DocumentStore create endpoint accepts a client-supplied primary key and persists it via TypeORM repository.save(), turning the POST into an implicit UPSERT that can UPDATE another tenant's record and reassign or modify it. SSVC rates technical impact as total and lists proof-of-concept exploitation; EPSS is low (0.05%), and it is not on CISA KEV.

Authentication bypass in FlowiseAI Flowise before 3.1.0 lets an unauthenticated remote attacker who knows a victim's email address take over their account by abusing the password reset flow. The resetPassword method of AccountService never verifies that a reset token was actually issued, and because the stored token defaults to null (or an empty string after a prior reset), submitting a null/empty token to /api/v1/account/reset-password sets an attacker-chosen password. Publicly available exploit code exists (ZDI-CAN-28762, SSVC exploitation:poc); it is not listed in CISA KEV and EPSS is low (0.15%, 35th percentile).

Remote code execution in FlowiseAI Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands on the server via the Airtable Agent node. Because LLM-generated Python is executed without proper sandboxing, an attacker who can send prompts to a chatflow containing this node can use prompt injection to coerce the model into emitting malicious Python that runs in the context of the Flowise process. Reported through Trend Micro ZDI (ZDI-CAN-29412); publicly available exploit code exists (SSVC: PoC), though EPSS is low at 0.06% and it is not listed in CISA KEV.

Cleartext transmission of password reset links in Flowise (via cloud.flowiseai.com) prior to version 3.1.0 allows a network-positioned man-in-the-middle attacker to intercept the reset token and hijack a victim's account. The reset email embeds the link over plain HTTP instead of HTTPS, so anyone sharing the victim's network (e.g., public Wi-Fi) can sniff the token during a reset flow. Publicly available exploit code exists (HackerOne report #1888915), but EPSS is very low (0.03%, 10th percentile) and there is no evidence of active exploitation.

Unauthenticated OAuth 2.0 access token disclosure in FlowiseAI Flowise before 3.1.0 lets remote attackers harvest valid third-party access tokens by chaining two unauthenticated endpoints. Because public chatflows expose their chatflowId by design, an attacker can query the public chatbot-config endpoint to read internal flowData containing OAuth credential identifiers, then invoke the unauthenticated token-refresh endpoint to mint live access tokens for services such as Gmail OAuth2. Publicly available exploit code exists (detailed PoC in the GHSA advisory); it is not listed in CISA KEV and EPSS is low (0.09%, 25th percentile).

Server-Side Request Forgery in Flowise's GET/POST API Chain components (versions prior to 3.1.0) lets unauthenticated remote attackers coerce the server into issuing arbitrary HTTP requests to internal and external hosts. Because the chain trusts LLM-generated URLs derived from user-supplied API documentation, an attacker injects a fake documentation prompt that overrides the intended BASE URL, enabling internal reconnaissance, cloud-metadata access, and data exfiltration. Publicly available exploit code exists (SSVC exploitation: poc), but EPSS is very low (0.05%) and the flaw is not in CISA KEV, so no active exploitation is confirmed.

Server-Side Request Forgery protection bypass in FlowiseAI Flowise (and the flowise-components package) before 3.1.0 lets low-privileged authenticated users reach internal and localhost services despite the built-in secureAxiosRequest/secureFetch wrappers. The wrappers fail open when HTTP_DENY_LIST is unset (the default), so no deny list is enforced at all, and even when configured they are defeatable via DNS rebinding (TOCTOU) between the validation lookup and the connection lookup. A vendor advisory (GHSA-2x8m-83vc-6wv4) and proof-of-concept confirm the flaw; publicly available exploit code exists, though EPSS is very low (0.04%) and it is not in CISA KEV.

Server-Side Request Forgery in FlowiseAI Flowise before 3.1.0 lets authenticated users abuse the Custom Function feature to reach internal network resources such as cloud metadata endpoints. The application's HTTP_DENY_LIST only wraps the axios and node-fetch libraries, so attacker-supplied JavaScript that imports the native Node.js http, https, or net modules sidesteps SSRF controls entirely. Publicly available exploit code exists (SSVC: PoC) with a demonstrated AWS EC2 IAM-credential theft path, though EPSS remains very low at 0.04%.

Malicious file upload leading to potential remote code execution in FlowiseAI Flowise before 3.1.0 lets an authenticated attacker bypass MIME-type restrictions in the Chatflow file-upload configuration to add the application/javascript type and store .js Node.js web shells on the server. Publicly available exploit code exists (working web shell and Python upload script published in the GHSA advisory), though EPSS remains very low at 0.06% (19th percentile). This is a bypass of the earlier fix for CVE-2025-61687 (GHSA-35g6-rrw3-v6xc), indicating incomplete prior remediation.

Remote code execution in Flowise before 3.1.0 lets an unauthenticated attacker run arbitrary OS commands as root inside the container with a single HTTP request. The flaw chains a parameter-override validation bypass (the FILE-STORAGE:: keyword check) with NODE_OPTIONS environment-variable injection through the Custom MCP node. Publicly available exploit code exists per the SSVC 'poc' rating, though EPSS is only 0.17%; no active exploitation has been confirmed.

Improper mass assignment in the account registration endpoint of Flowise (Flowise Cloud, versions prior to 3.1.0) lets unauthenticated attackers smuggle server-managed fields and nested objects into the POST /api/v1/account/register payload, forging ownership metadata, timestamps, organization association, and role mappings. In a multi-tenant SaaS deployment this breaks tenant trust boundaries, potentially letting an attacker attach a freshly-registered account to an existing organization with an elevated role. Publicly available exploit code exists (a working PoC is published in the GitHub Security Advisory), but the issue is not in CISA KEV and EPSS is very low (0.04%, 13th percentile).

Unauthenticated sensitive data disclosure in FlowiseAI Flowise before 3.1.0 lets any remote party retrieve stored secrets by requesting /api/v1/public-chatbotConfig/:id with only a chatflow UUID. The endpoint returns the full flowData object - including plaintext password-type fields (e.g. Unstructured API keys), HTTP Authorization headers from Requests nodes, and internal endpoint/webhook URLs - with no authorization check, enabling credential theft and downstream pivoting. Publicly available exploit code exists (vendor GHSA advisory with PoC), though EPSS is very low (0.05%, 15th percentile) and it is not on CISA KEV.

Authenticated remote code execution in FlowiseAI Flowise (and the flowise-components package) prior to 3.1.0 arises from the CSVAgent node, which interpolates a user-supplied 'customReadCSV' Pandas string directly into Python code executed via pyodide. An authenticated attacker (or an unauthenticated one when FLOWISE_USERNAME/FLOWISE_PASSWORD are unset, via the 'x-request-from: internal' header bypass) can inject Python such as 'import os;os.system(...)' to run arbitrary commands on the server. Publicly available exploit code exists (PoC in the GHSA advisory); this is not listed in CISA KEV, and EPSS is modest at 0.62% (70th percentile).

Remote code execution in FlowiseAI Flowise before 3.1.0 allows an attacker to abuse the AirtableAgent node, which passes unsanitized user question input into a Python code template executed via Pyodide/Pandas. Because the question is reflected directly into the generated Python without validation, a crafted prompt-injection payload escapes the intended LLM behavior and executes arbitrary Python. SSVC rates technical impact as total with a public proof-of-concept, though EPSS remains low at 0.43% (63rd percentile) and there is no public exploit identified in CISA KEV at time of analysis.

Flowise versions prior to 3.0.13 allow unauthenticated users to trigger Server-Side Request Forgery (SSRF) attacks through improperly validated URLs in the HTTP Node component, enabling attackers to probe internal networks and cloud metadata endpoints from the Flowise server. Public exploit code exists for this vulnerability, and no patch is currently available for affected deployments. Any organization running a publicly exposed Flowise instance is at immediate risk of internal network reconnaissance and potential credential theft from cloud environments.

Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerability data. PoC available.

Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).

Flowise versions up to 3.0.13 is affected by improperly controlled modification of dynamically-determined object attributes (CVSS 7.7).

Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthenticated attackers to upload and execute malicious files. PoC available.

Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoofing an internal request header, granting access to sensitive administrative functions including API key and credential management. Public exploit code exists for this vulnerability, and an attacker with valid tenant credentials can escalate to administrative privileges without additional authentication. No patch is currently available for affected deployments.

Authenticated remote code execution in FlowiseAI Flowise (v3.0.1 up to but not including 3.0.8, and later versions when 'ALLOW_BUILTIN_DEP' is enabled) lets a logged-in user break out of the nodevm sandbox by abusing the bundled Puppeteer and Playwright modules. Because a custom tool can specify an attacker-controlled browser binary path and launch parameters, executing that tool runs an arbitrary executable on the host outside the intended sandbox, yielding code execution in the host context. Publicly available exploit code exists; the flaw is not listed in CISA KEV, and it was mis-filed by the vendor as a duplicate of CVE-2025-26319 but is distinct.

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig parameter is parsed unsafely, allowing attackers to inject arbitrary system commands through the MCP server configuration that are executed when Flowise spawns the MCP server process.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS commands. The combination of no default authentication and the ability to spawn local processes via tools like npx enables unauthenticated remote code execution on any Flowise installation.

Flowise <= 2.2.3 is vulnerable to SQL Injection. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Unauthenticated attackers can upload malicious files including executable scripts, achieving remote code execution on the Flowise server.

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Flowise is a drag & drop user interface to build a customized large language model flow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.