flowiseai flowise vulnerabilities in 2025, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 6.5CVE-2025-57164EPSS 0.6%
Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.
- 8.4CVE-2025-34267EPSS 6.9%
Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) wit…
- 9.9CVE-2025-61913EPSS 14%
Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit th…
- 8.8CVE-2025-61687EPSS 12%
Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables…
- 6.1CVE-2025-50538EPSS 15%
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
- 6.1CVE-2025-29192EPSS 0.4%
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
- 10.0CVE-2025-59528ExploitEPSS 92%
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an…
- 7.5CVE-2025-59527EPSS 5.5%
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. Th…
- 9.6CVE-2025-59434EPSS 4.4%
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive enviro…
- 9.8CVE-2025-58434ExploitEPSS 84%
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` wit…
- 9.8CVE-2025-8943ExploitEPSS 75%
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access contro…
- 7.6CVE-2025-29189EPSS 0.3%
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
- 9.8CVE-2025-26319ExploitEPSS 56%
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.