Threat database

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 contain a vulnerability where the DatasetRow create and update functionality allows mass-assignment that can lead to cross-workspace row takeover. This issue is classified under CWE-915, indicating improper control of dynamically-determined object attributes. The vulnerability has been fixed in version 3.1.2.

Flowise versions prior to 3.1.2 contain a vulnerability where mass-assignment in dataset creation and update allows cross-workspace dataset takeover. This issue has been addressed in version 3.1.2. The vulnerability involves improperly controlled modification of dynamically-determined object attributes, classified as CWE-915.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace assistant takeover. This issue has been patched in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 have a vulnerability where the encryptedData field is exposed in credential fetch responses when using a credentialName filter. This exposure of sensitive information occurs because the encryptedData field is not properly omitted in filtered responses, unlike unfiltered ones. The issue has been fixed in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 contain a critical code injection vulnerability in the POST /api/v1/node-custom-function endpoint. This endpoint lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript code. When the E2B_APIKEY is not configured, the submitted code executes inside a NodeVM sandbox that can be escaped, enabling attackers to execute system commands on the host. This results in authenticated remote code execution on the Flowise server host. The vulnerability is patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side validation and authorization checks, an authenticated user can manipulate internal attributes of a chatflow and reassign it to another workspace. This allows cross-workspace resource reassignment and unauthorized modification of deployment and visibility settings. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 contain a mass assignment vulnerability in the variable update endpoint. Authenticated users can modify server-controlled properties such as workspaceId without proper authorization checks, allowing reassignment of variables to arbitrary workspaces. This can break tenant isolation in multi-workspace environments. The issue has been fixed in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API key auth (not whitelisted), but no permission checks exist on any operation. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.

A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.service.ts of the component Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. Upgrading the affected component is recommended.

A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller Handler. This manipulation of the argument userId/organizationId/workspaceId/email causes authorization bypass. The attack may be initiated remotely. The affected component should be upgraded.

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.

Flowise versions prior to 3.1.0 contain a critical vulnerability (CVE-2026-41274) in the GraphCypherQAChain node, where user input is directly passed into the Cypher query execution pipeline without proper sanitization. This allows attackers to inject arbitrary Cypher commands, potentially leading to unauthorized data exfiltration, modification, or deletion on the underlying Neo4j database. The vulnerability is fixed in version 3.1.0. There are no known exploits in the wild at this time.

FlowiseAI Flowise versions prior to 3.1.0 contain a critical remote code execution vulnerability (CVE-2026-41264) in the CSV_Agents class. This vulnerability is due to insufficient sandboxing of Python scripts generated by the LLM, which allows unauthenticated attackers to execute arbitrary Python code with the privileges of the Flowise server user. The issue is fixed in version 3.1.0.

CVE-2026-41265 is a critical command injection vulnerability in FlowiseAI's Flowise product versions prior to 3.1.0. The flaw exists in the run method of the Airtable_Agents class, where an LLM-generated Python script is evaluated without proper sandboxing. An unauthenticated attacker can use prompt injection to cause the LLM to generate and execute malicious Python code on the server. This vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability. The issue is fixed in version 3.1.0.