CVE-2026-91937

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version.

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints. An authenticated user can supply an unscoped chatflowid to access tools from ChatFlows in other workspaces.

Flowise before 3.1.4 contains a validation bypass in MCP server configuration allowing an authenticated attacker to achieve remote code execution through an unvalidated cwd parameter. The attacker can bypass path validation using clean filenames in the args array while controlling the working directory.

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows an authenticated attacker to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. The attacker can invoke npx with attacker-controlled npm packages.

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. An attacker can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations.

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. An attacker with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.