Search: CVE-2024-58351

Flowise versions before 2.1.4 contain a critical code injection vulnerability via the overrideConfig option, which is enabled by default. This flaw allows attackers to inject configuration into the Chainflow during execution, leading to remote code execution, sandbox escape, denial of service, server-side request forgery, prompt injection, and data exfiltration. The vulnerability affects both the frontend web integration and the backend Prediction API. Exploitation impacts only the attacker’s own session and does not persist or affect other users.