Threats tagged 'ghsa-c6xh-wv4j-ppv5'

Flowise versions prior to 3.1.3 contain a Server-Side Request Forgery (SSRF) vulnerability due to improper normalization of IPv4-mapped IPv6 addresses in its HTTP security module. This allows attackers controlling DNS resolution to bypass IP deny lists and make requests to localhost, internal services, or cloud metadata endpoints. The issue is fixed in version 3.1.3.