Threats tagged 'ghsa-9c4c-g95m-c8cp'

FlowiseDB versions up to 2.2.7 contain an SQL injection vulnerability in the importChatflows API, exploitable by authenticated users. The vulnerability arises from unsafe construction of SQL queries using user-supplied chatflow IDs without proper validation or sanitization. This allows attackers to inject malicious SQL code, potentially leading to data leakage or manipulation. Additionally, insufficient validation of chatflow IDs can lead to path traversal issues when importing crafted JSON files. The vulnerability has a CVSS score of 5.9 (medium severity).