CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery (SSRF) vulnerability in the Cheerio, Playwright, and Puppeteer document loader nodes. The flaw bypasses the built-in SSRF protection, allowing an attacker with low privileges to supply arbitrary URLs that cause the server to fetc...