Threats affecting pkg:github/flowiseai/Flowise

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.

Flowise versions prior to 3.1.3 contain a Server-Side Request Forgery (SSRF) vulnerability due to improper normalization of IPv4-mapped IPv6 addresses in its HTTP security module. This allows attackers controlling DNS resolution to bypass IP deny lists and make requests to localhost, internal services, or cloud metadata endpoints. The issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.

CVE-2026-69255 is a critical code injection vulnerability in Flowise versions prior to 3.1.3. It arises from improper handling of attacker-controlled CSV data in the CSVAgent component, where unvalidated input is interpolated directly into executable Python code. This flaw allows an authenticated attacker to execute arbitrary operating system commands with root privileges in the Flowise container. The issue is fixed in version 3.1.3.

CVE-2026-69254 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. It allows an authenticated attacker with limited privileges to execute arbitrary system commands as root by exploiting improper control over JavaScript code execution options. The flaw arises from the executeJavaScriptCode() function merging caller-provided NodeVM options over default security settings, enabling escalation to full system command execution. This issue is fixed in Flowise version 3.1.3.

FlowiseAI Flowise versions prior to 3.1.3 contain a missing authorization vulnerability in the /api/v1/files API endpoint. Low-privileged authenticated API keys with unrelated permissions could list and delete files across different workspaces within the same organization due to insufficient permission checks. This issue is resolved in version 3.1.3.

Flowise versions prior to 3.1.3 contain a code injection vulnerability in record manager and agent memory nodes. Authenticated users can set arbitrary TypeORM DataSource options via the additionalConfig input, enabling them to load local JavaScript files and execute arbitrary code on the server. This vulnerability is fixed in version 3.1.3.

Flowise versions prior to 3.1.3 contain an authorization bypass vulnerability in the OAuth2 token refresh endpoint. This endpoint is unauthenticated by design and allows an attacker to trigger server-side HTTP requests to attacker-controlled URLs without SSRF protections. Sensitive OAuth2 credentials are sent in these requests, and the full remote response is reflected back to the caller. The issue is fixed in version 3.1.3.

Flowise versions 3.0.13 and earlier use weak hardcoded default JWT secrets and default audience and issuer values in their enterprise passport authentication middleware. If the environment variables for these JWT parameters are not set, the application falls back to publicly known default values, enabling attackers to forge valid JWTs and impersonate any user, including administrators, leading to authentication bypass.

Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its text-to-speech (TTS) generation endpoint (packages/server/src/controllers/text-to-speech/index.ts), independent of the server's configured CORS policy. This bypasses the server's otherwise restrictive default CORS configuration (getCorsOptions()) and allows any webpage to make cross-origin requests that trigger TTS generation using stored credentials, enabling drive-by cross-origin credential abuse.

Flowise versions 3.0.7 and earlier do not invalidate existing sessions or session tokens after a user changes their password. This allows an attacker with an active session, such as one obtained via a stolen token or a device left logged in, to remain authenticated despite the password change. This behavior undermines the security intent of password rotation by allowing continued unauthorized access.

Flowise versions before 3.0.6 have an arbitrary file read vulnerability in the chatId parameter of two API endpoints. The chatId parameter is not properly validated, allowing path traversal beyond the intended storage directory. This enables unauthenticated attackers to read sensitive files such as the default database file, exposing all database content.

Flowise versions through 2.2.4 have an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. This vulnerability allows attackers to exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories. Successful exploitation could lead to remote code execution and server compromise.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace evaluator takeover. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.

Flowise versions prior to 3.1.2 contain a vulnerability where mass-assignment in dataset creation and update allows cross-workspace dataset takeover. This issue has been addressed in version 3.1.2. The vulnerability involves improperly controlled modification of dynamically-determined object attributes, classified as CWE-915.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace assistant takeover. This issue has been patched in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 have a vulnerability where the encryptedData field is exposed in credential fetch responses when using a credentialName filter. This exposure of sensitive information occurs because the encryptedData field is not properly omitted in filtered responses, unlike unfiltered ones. The issue has been fixed in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.