CVE-2024-31621

FlowiseAI Inc Flowise versions v.1.6.2 and before (and some sources indicate prior to v.1.8.1 ) are vulnerable to a Code Injection (CWE-94) flaw. Due to improper input validation in the api/v1 component, a remote attacker can execute arbitrary code by submitting a crafted script. Additionally, ve...

CVE-2025-59528

Flowise 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig string is parsed and passed to the Function() constructor via convertToValidJSONString without validation, allowing an attacker to execute arbitrary JavaScript with Node.js privileges (e.g., ac...

CVE-2026-41276

Flowise (FlowiseAI Flowise) has a REST-authentication bypass vulnerability in the AccountService.resetPassword flow. Before version 3.1.0, an attacker who knows a user’s email can request a password reset with a null/empty token, bypass the need for a valid reset token, and set the user’s passwor...

CVE-2026-40933

Flowise: Authenticated RCE via MCP adapters. Prior to 3.1.0, unsafe serialization of stdio commands in the MCP adapter allows an authenticated attacker to add an MCP stdio server and run arbitrary OS commands, due to a bug in input sanitization in the Custom MCP configuration (http://localhost:30...

CVE-2025-26319

FlowiseAI Flowise version 2.2.6 and below contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. An unauthenticated attacker can exploit a path traversal flaw by manipulating the chatId parameter (e.g., using ../../../) to upload files outside the intended directory....

CVE-2025-58434

Flowise was vulnerable in versions up to 3.0.5 where the forgot-password API returned a valid tempToken and other sensitive user data without authentication, enabling an unauthenticated attacker to reset passwords and take over accounts (including admins). A fix was released in version 3.0.6 that...

CVE-2026-70636

Flowise 3.1.4 contains an authentication bypass affecting the OAuth2 credential refresh endpoint. The root cause is a prefix-based whitelist in the authentication middleware (packages/server/src/utils/constants.ts) that allows an unauthenticated POST to the oauth2-credential refresh route when a ...

CVE-2026-46442

Flowise prior to v3.1.2 exposes an unauthenticated route POST /api/v1/node-custom-function that can accept arbitrary JavaScript in a Custom JS Function node. If E2B_APIKEY is not configured, code runs in a NodeVM sandbox and can be escaped to reach host process and execute system commands, enabli...

CVE-2024-36420

Flowise 1.4.3 is vulnerable to arbitrary file read via POST /api/v1/openai-assistants-file due to lack of sanitization of the fileName parameter in index.ts. Exploitation is demonstrated in multiple sources (e.g., nuclei templates and GitHub PoCs) showing reading /etc/passwd when sending crafted ...

CVE-2024-36423

Flowise 1.4.3 has a reflected cross-site scripting (XSS) vulnerability in the endpoint /api/v1/public-chatflows/id. When configured unauthenticated, an attacker can craft a URL that injects JavaScript into user sessions, potentially stealing information, creating false popups, or redirecting user...

CVE-2026-69264

Flowise CSVAgent is affected. Prior to 3.1.3, an attacker-controlled segment of csvFile’s data URI is interpolated into a Python source-template executed by Pyodide; due to the default js bridge to globalThis in Node.js, this can be passed to js.eval and dynamically import Node built-ins (e.g., f...

CVE-2026-41265

CVE-2026-41265 affects Flowise with the Airtable_Agents class, where the run method evaluates an LLM-generated Python script without proper sandboxing. This allows prompt-injection via chatflows to coax the LLM into returning a malicious Python script that executes attacker-controlled commands on...

CVE-2026-69254

CVE-2026-69254 affects Flowise versions before 3.1.3. The issue arises in the executeJavaScriptCode() path where caller-provided nodeVMOptions are merged with default NodeVM security settings, allowing an attacker to override the sandbox protection. By reaching packages/server/src/routes/node-cus...

CVE-2026-69253

Summary of findings (CVE-2026-69253). Flowise allowed in-process vm2 sandbox JavaScript execution for several tools (AgentAsTool, ChatflowTool, ExecuteFlow) with the baseURL injected into generated code, enabling code injection and sandbox escape. The vulnerability arises because baseURL validati...

CVE-2024-8181

Affected software: Flowise

CVE-2026-42861

Summary: CVE-2026-42861 affects Flowise (pre-3.1.2) with a mass assignment flaw in the variable update endpoint. What’s vulnerable: the PUT /api/v1/variables/{variableId} endpoint allows authenticated users to modify server-controlled fields (workspaceId, createdDate, updatedDate) by submitting t...

CVE-2026-46443

FlowiseAI Flowise (Flowise server) has a credential data leak when querying credentials with a credentialName filter. In versions prior to 3.1.2, the encryptedData field is not removed from the API response for filtered credential fetches, exposing sensitive credential data (API keys, passwords, ...

CVE-2026-46475

CVE-2026-46475 concerns FlowiseAI’s assistant management flow. The vulnerability arises from mass-assignment via Object.assign during create/update of an Assistant entity, which copies client-supplied fields such as workspaceId and id into the persistence model without an allowlist. The result is...

CVE-2024-37146

Flowise 1.4.3 contains a reflected XSS in /api/v1/credentials/id. When unauthenticated, an attacker can craft a URL that injects JavaScript into user sessions (stealing data, creating popups, or redirecting). If the chatflow ID is not found, the value is reflected on the 404 page, enabling arbitr...

CVE-2024-36422

CVE-2024-36422 : Flowise v1.4.3 exposes a reflected XSS vulnerability at api/v1/chatflows/id. When unauthenticated, an attacker can craft a URL to inject JavaScript into a user session, enabling information theft, popups, or redirects. If the chatflow ID is not found, the reflected value appears ...

CVE-2024-37145

Flowise v1.4.3 exposes a reflected XSS in /api/v1/chatflows-streaming/id. An unauthenticated user can craft a URL to inject Javascript, potentially exfiltrating data, creating popups, or redirecting users, with reflection on 404 HTML pages enabling script attachment. This XSS may be chained with ...

CVE-2026-46441

CVE-2026-46441 affects Flowise versions prior to 3.1.2. A mass assignment flaw allows authenticated users to modify server-controlled fields (workspaceId, createdDate, updatedDate) via PUT /api/v1/assistants/{assistantId}, enabling cross-workspace reassignment of assistants and breaking tenant is...

CVE-2026-69258

Flowise , an open-source drag-and-drop LLM flow builder, is vulnerable to unauthenticated property injection in versions prior to 3.1.3 . The POST /api/v1/prediction/:id endpoint accepts an overrideConfig object that is unconditionally spread into internal flowConfig and flowData objects without ...

CVE-2024-8182

Flowise vulnerability CVE-2024-8182 is an unauthenticated Denial of Service affecting Flowise v1.8.2. The issue stems from improper handling of user-supplied input to the /api/v1/get-upload-file endpoint, which can cause the instance to crash when processing requests. The available connected docu...

CVE-2026-41279

Flowise prior to v3.1.0 exposed an unauthenticated text-to-speech endpoint (POST /api/v1/text-to-speech/generate) that accepts a credentialId and, when called without a chatflowId, decrypts the stored credential to generate speech. This creates risk of credential misuse and API credit abuse, as t...

CVE-2025-8943

Flowise CVE-2025-8943 affects Flowise versions before 3.0.1. The vulnerability resides in the Custom MCPs feature, specifically the /api/v1/node-load-method/customMCP endpoint, where insufficient authentication/authorization allows unauthenticated network attackers to execute OS commands unsandbo...

CVE-2026-67622

Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...

CVE-2026-69263

Flowise (a drag-and-drop UI for building LLM workflows) prior to 3.1.3 has a patch bypass of CVE-2025-8943 in packages/components/nodes/tools/MCP/core.ts. The original fix blocked -y/--yes flags on npx, but the environment-variable denylist only rejected PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, ...

CVE-2026-69251

Flowise prior to version 3.1.3 is affected by a RCE in the TypeORM DataSource configuration via the additionalConfig input on specific nodes (record managers and agent memory nodes for MySQL, Postgres, SQLite, and MySQL/AgentMemory). The issue allows an authenticated user to inject arbitrary Java...

CVE-2026-70478

Summary of CVE-2026-70478 (Flowise) : The unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is exposed via WHITELIST_URLS and decrypts the stored credential to perform an OAuth token refresh, returning a new access_token in the response. An attacker with a valid creden...

CVE-2026-69255

Flowise (drag-and-drop LLM flow builder) versions prior to 3.1.3 are vulnerable to arbitrary code execution via the CSVAgent component. Attacker-controlled CSV data is interpolated directly into executable Python before being passed to Pyodide , bypassing the validatePythonCodeForDataFrame() deny...

CVE-2026-46444

FlowiseAI’s OpenAI Assistants Vector Store endpoints (/api/v1/openai-assistants-vector-store) were vulnerable in pre-3.1.2 releases: all CRUD routes lacked authentication middleware and did not enforce permissions, allowing any authenticated user to create, update, delete, or upload files to vect...

CVE-2026-46478

CVE-2026-46478 describes a mass‑assignment flaw in FlowiseAI’s DatasetRow handling prior to version 3.1.2. The server copies the request body onto a new DatasetRow via Object.assign, allowing client-controlled fields such as workspaceId and id to be written to the persisted row. This enables cros...

CVE-2026-58057

Flowise before 3.1.3 is affected: a case-sensitive denylist for Custom MCP stdio environment variables allows bypass on Windows (case-insensitive env names). An authenticated user who can configure a Custom MCP node can inject NODE_OPTIONS --require to execute arbitrary code in the Flowise server...

CVE-2026-70474

Flowise (flows builder UI) has a cross-workspace OAuth2 credential metadata leak prior to version 3.1.3. Three OAuth2 credential endpoints—/api/v1/oauth2-credential/authorize/, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=, and /api/v1/oauth2-credential/refresh/—query the Cred...

CVE-2026-46440

Flowise CVE-2026-46440 affects Flowise versions before 3.1.2. The vulnerability is in the checkBasicAuth endpoint, which validates credentials in plaintext using direct comparison and without rate limiting. This can enable credential brute-forcing and enumeration, potentially granting access to t...

CVE-2026-69250

Summary: CVE-2026-69250 affects Flowise up to version 3.1.2 (pre-3.1.3). The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is publicly whitelisted and unauthenticated. The endpoint performs a server-side HTTP request to a credential-controlled accessTokenUrl w...

CVE-2026-41268

Flowise is affected by a critical unauthenticated remote command execution (RCE) prior to version 3.1.0. The vulnerability arises from a parameter override bypass that combines the FILE-STORAGE:: keyword with a NODE_OPTIONS environment variable injection, allowing arbitrary root commands to be ex...

CVE-2026-56270

Flowise versions prior to 3.1.0 (specifically 3.0.13 and earlier) are vulnerable to a missing authentication flaw in the /api/v1/loginmethod endpoint. This allows unauthenticated remote attackers to retrieve an organization's complete SSO configuration , including OAuth client secrets in cleartex...

CVE-2026-70477

Flowise CSV Agent prompt injection leads to remote code execution. In Flowise prior to 3.1.3, the CSV_Agents.run method uses untrusted data to build an LLM prompt, and the resulting pythonCode is executed after a validation step, which can bypass safeguards and run arbitrary code in the service a...

CVE-2026-70472

Flowise CVE-2026-70472 affects the openai-assistants-vector-store endpoints (prior to 3.1.3). A client-controlled credential parameter is loaded by id without validating workspace ownership; the controller passes req.query.credential to the service, which finds by id, decrypts the credential, and...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 expose a missing authorization vulnerability in POST /api/v1/openai-assistants-file/download. An unauthenticated attacker can bypass the global authentication whitelist to bypass session and API key verification and retrieve private files by supplying valid ch...

CVE-2026-41138

Summary (CVE-2026-41138): Flowise Flowise 3.x contains a remote code execution vulnerability in the Airtable_Agent path (AirtableAgent.ts) due to lack of input verification when using Pandas. User input is injected into the prompt’s question parameter and reflected into Python code without saniti...

CVE-2026-42863

Summary. FlowiseAI’s Flowise product has a mass-assignment vulnerability in the chatflow update endpoint that lets an authenticated user modify server-controlled fields (deployed, isPublic, workspaceId, createdDate, updatedDate, etc.) and reassign a chatflow to another workspace. The issue stems ...

CVE-2026-70471

CVE-2026-70471 – Flowise RBAC bypass : Prior to Flowise 3.1.3, unauthorized users (including keys) could access workspace-scoped variables via /api/v1/node-custom-function because $vars were injected into the code sandbox without requiring variables:view, bypassing the Variables API. Variables fo...

CVE-2026-70476

Flowise (drag‑and‑drop UI for building LLM flows) has a Broken Access Control in Stripe subscription endpoints. Prior to version 3.1.3, endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accepted attac...

CVE-2026-46477

FlowiseAI’s CVE-2026-46477 describes a mass-assignment vulnerability in the dataset service prior to version 3.1.2. The code uses Object.assign to copy the request body into a new Dataset for create and update, allowing client-controlled fields such as workspaceId and id to overwrite persisted va...

CVE-2026-67620

CVE-2026-67620 affects Flowise up to version 3.1.4, where the SSRF guard in httpSecurity.ts uses a faulty DEFAULT_DENY_LIST. The list blocks the AWS/GCP/Azure/DO metadata IPs 169.254.169.254 but omits OCI 192.0.0.192 and Alibaba Cloud 100.100.100.200 (and the 100.64.0.0/10 CGNAT range). An authen...

CVE-2024-9148

Summary: CVE-2024-9148 affects Flowise before 2.1.1 and Flowise Chat Embed before 2.0.0. It is a stored Cross-Site Scripting vulnerability caused by insufficient input sanitization. Authors/maintainers indicate fixes via version updates. Impact details in connected documents cite stored XSS with ...

CVE-2026-46479

CVE-2026-46479 concerns FlowiseAI’s evaluation management. The vulnerability arises from using Object.assign to copy client-provided fields into a new Evaluation object, allowing an attacker to overwrite ownership fields such as workspaceId or id during create/update. This can enable cross-worksp...