CVE-2026-91937

CVE-2026-91937 is a NoSQL Injection vulnerability in Flowise before 3.1.4 . The MongoDBMemory node fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat his...