CVE-2025-29189

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.

A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.

Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.

Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.

Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.

Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.