Threats affecting pkg:npm/flowise-components

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which internally invokes child_process.spawn() outside the sandbox boundary. This allows execution of arbitrary OS commands as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// URL handling. In versions 3.0.8–3.1.2 exploitation requires ALLOW_BUILTIN_DEP=true; earlier versions are exploitable by default. Fixed in 3.1.3.

Flowise versions prior to 3.1.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the Execute Flow function. An attacker can supply an intranet address via the base URL field, bypassing internal checks, causing the server to make HTTP requests to internal network addresses. This may allow attackers to enumerate internal services, access sensitive management interfaces, or leak confidential information. A fix is available that involves calling secureFetch for verification.

Flowise versions prior to 3.0.8 contain a vulnerability in the ReadFileTool that allows authenticated users to read arbitrary files on the server filesystem. This occurs because the tool does not restrict file path access, enabling attackers to access sensitive files such as encryption keys and database files. The vulnerability has been confirmed in the latest Flowise Docker image and can lead to remote command execution. A fix is available in version 3.0.8.

Flowise contains a critical vulnerability in its WriteFileTool that allows authenticated users to write arbitrary files to any location on the server's file system. This lack of path restriction can lead to remote command execution by overwriting sensitive files such as SSH authorized keys or system libraries. The vulnerability affects Flowise versions prior to 3.0.8 and has been confirmed in the latest Docker image. A fix is available in version 3.0.8.