Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a critical code injection vulnerability in the CSVAgent component. This vulnerability allows attackers to supply malicious Pandas CSV read code that is not properly sanitized, leading to command injection and remote code execution on the server. The issue is resolved in version 3.1.0.
FlowiseAI Flowise versions prior to 3.1.0 contain a high-severity remote code execution vulnerability (CVE-2026-41138) due to improper input sanitization in the AirtableAgent.ts component. User input is directly injected into a Python prompt template without verification, enabling code injection. This vulnerability is fixed in version 3.1.0. No known exploits are reported in the wild. Patch status is not explicitly confirmed in the advisory, so users should verify vendor guidance.
CVE-2026-40933 is a critical OS command injection vulnerability in FlowiseAI's Flowise product prior to version 3.1.0. It arises from unsafe serialization of stdio commands in the MCP adapter, allowing an authenticated attacker to add a malicious MCP stdio server with arbitrary commands. Despite input sanitization attempts, attackers can bypass these checks and execute arbitrary OS commands. This vulnerability is fixed in Flowise version 3.1.0.
Flowise versions prior to 3.1.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the Execute Flow function. An attacker can supply an intranet address via the base URL field, bypassing internal checks, causing the server to make HTTP requests to internal network addresses. This may allow attackers to enumerate internal services, access sensitive management interfaces, or leak confidential information. A fix is available that involves calling secureFetch for verification.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Request Forgery (SSRF), allowing any user interacting with a publicly exposed chatflow to force the Flowise server to make requests to internal network resources that are inaccessible from the public internet. This vulnerability is fixed in 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to account takeover and enterprise feature bypass via SSO configuration. This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. While the server validates uploads based on the MIME types defined in chatbotConfig.fullFileUpload.allowedUploadFileTypes, it implicitly trusts the client-provided Content-Type header (file.mimetype) without verifying the file's actual content (magic bytes) or extension (file.originalname). Consequently, an attacker can bypass this restriction by spoofing the Content-Type as a permitted type (e.g., application/pdf) while uploading malicious scripts or arbitrary files. Once uploaded via addArrayFilesToStorage, these files persist in backend storage (S3, GCS, or local disk). This vulnerability serves as a critical entry point that, when chained with other features like static hosting or file retrieval, can lead to Stored XSS, malicious file hosting, or Remote Code Execution (RCE). This issue has been patched in version 3.0.13.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the header x-request-from: internal, allowing an authenticated tenant session to bypass all /api/v1/** authorization checks. With only a browser cookie, a low-privilege tenant can invoke internal administration endpoints (API key management, credential stores, custom function execution, etc.), effectively escalating privilege. This issue has been patched in version 3.0.13.
Flowise, an open-source user interface for creating Large Language Models (LLMs), has multiple vulnerabilities that allow attackers to bypass security measures. These issues affect versions prior to 3.0.10. A fix addressing these vulnerabilities is available in version 3.0.10.
CVE-2025-57164 is a medium severity remote code execution vulnerability in Flowise up to version 3.0.4. It arises from unsanitized evaluation of user input in the 'Supabase RPC Filter' field, allowing attackers to execute arbitrary code remotely without authentication or user interaction. The vulnerability is linked to CWE-77, indicating improper neutralization of special elements used in commands. Although no known exploits are currently in the wild, the vulnerability poses a risk to confidentiality and integrity. European organizations using Flowise, especially in sectors relying on Supabase integrations, should prioritize patching or mitigating this flaw. The vulnerability’s network attack vector and lack of required privileges increase its risk profile. Countries with higher adoption of Flowise or Supabase-based solutions, such as Germany, the UK, and the Netherlands, are more likely to be affected. Immediate mitigation includes input validation, restricting RPC filter usage, and monitoring for suspicious activity.
