{"cve":"CVE-2024-58351","nvd":{"published":"2026-06-20T16:17:03.973","modified":"2026-10-27T18:10:00.130","status":"Deferred","description":"Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allow-list of permitted variables and relies on vm2 for sandboxing, an attacker can abuse it to achieve remote code execution and sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server variable and data exfiltration. These issues are self-targeted and do not persist to other users.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-94"],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5cph-wvm9-45gj","https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-overrideconfig-parameter"],"products":[],"source":"nvd","synced_at":"2026-10-27T18:39:43.087796372+00:00"},"epss":{"cve":"CVE-2024-58351","score":0.00926,"percentile":0.60287,"date":"2026-10-27"},"kev":null,"osv":[{"id":"GHSA-5cph-wvm9-45gj","url":"https://osv.dev/vulnerability/GHSA-5cph-wvm9-45gj","summary":"Flowise OverrideConfig security vulnerability","modified":"2026-09-14T18:15:04.936939710Z","packages":[{"ecosystem":"npm","name":"flowise","purl":"pkg:npm/flowise","ranges":["<2.1.4"],"fixed":["2.1.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}