CVE-2026-91938

7.6 highEPSS 0.4%

High (7.6). EPSS 0.4% chance of exploitation in the next 30 days.

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Severity

CVSS 4.0

7.6 high

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-09-15
Modified: 2026-09-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9cvr-5wv9-2gxr
https://www.vulncheck.com/advisories/flowise-before-3.1.4-server-side-request-forgery-via-document-loaders

Check your stack JSON