CVE-2026-30822

7.7 highEPSS 13%

High (7.7) in flowiseai flowise. EPSS 13% chance of exploitation in the next 30 days. Fixed in flowise 3.0.13.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. This issue has been patched in version 3.0.13.

Severity

CVSS 3.0

7.7 high

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-915
Published: 2026-03-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

flowiseai:flowise

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-mq4r-h2gh-qv7x	npm	flowise	<3.0.13	3.0.13

References

https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.13
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-mq4r-h2gh-qv7x

Check your stack JSON