Flowise vulnerabilities

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4 CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain, Document Loader, MCP tool, or other paths using secureAxiosRequest(), secureFetch(), or checkDenyList() could return a AAAA record for an IPv4-mapped target and cause requests to reach localhost, internal services, or cloud metadata endpoints. This issue is fixed in version 3.1.3.

Missing permission check on the /api/v1/files route in Flowise before version 3.1.3, allowing low-privileged API keys to list and delete files across the organization.

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.

Flowise before 3.1.3 contains a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments.

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques.

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques.

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), allowing execution of arbitrary OS commands and arbitrary host file disclosure.

A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.

Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.

Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.

Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.

Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.

Flowise prior to 3.1.3 contains a vulnerability in the SQLite Record Manager node that allows an authenticated attacker to overwrite the SQLite database path and place malicious syntax in a configuration file, potentially leading to code execution when Chromium is launched.

Flowise prior to 3.1.3 contains a vulnerability in the CSVAgent node that allows an authenticated user to execute arbitrary code by deserializing a malicious pickle payload, bypassing the denylist of dangerous Python constructs.

Flowise before version 3.1.3 has a vulnerability in the CSVAgent component where attacker-controlled CSV data is directly interpolated into Python code executed by Pyodide. An authenticated attacker can inject Python code that uses Pyodide's js bridge to load child_process and execute arbitrary system commands as root in the Flowise container.

Flowise before version 3.1.3 has a vulnerability in executeJavaScriptCode() that accepts caller-provided nodeVMOptions and merges them over the default NodeVM security settings. An authenticated attacker can run a custom function that imports utils.js, calls executeJavaScriptCode() with options allowing all built-in modules, and then uses child_process to execute arbitrary system commands as root on the Flowise server.

Flowise before version 3.1.3 has a code injection vulnerability in the AgentAsTool, ChatflowTool, and ExecuteFlow components that run code in the vm2 sandbox. The user-controlled baseURL value is inserted directly into JavaScript code, and the only validation is isValidURL, which does not prevent breaking out of the string. An authenticated user can inject their own JavaScript code, which can escape the sandbox and execute arbitrary code on the Flowise server.

Flowise prior to 3.1.3 allows authenticated users to set arbitrary TypeORM DataSource options through the additionalConfig input in several record manager and agent memory nodes. Options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.

Flowise before version 3.1.0 (versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware. When the corresponding environment variables are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators.

Flowise before version 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set. Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

Flowise before version 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature. An attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, leading to complete compromise of the platform container or server.

Flowise before version 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

Flowise through version 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Flowise versions before 2.1.4 allow configuration to be injected into the Chainflow during execution via the overrideConfig option. This feature is enabled by default and lacks a allow-list of permitted variables, enabling attackers to achieve remote code execution and other serious attacks.

A vulnerability in Flowise prior to version 3.1.2 allows an authenticated attacker to achieve remote code execution by submitting arbitrary JavaScript to the Custom JS Function node. Missing authorization on the POST /api/v1/node-custom-function endpoint.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the assistant update endpoint. An authenticated user can modify server-controlled properties such as workspaceId, createdDate, and updatedDate. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces.

In Flowise prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This allows an attacker to perform a brute-force attack on passwords.

In Flowise prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint. An authenticated attacker can modify server-controlled properties such as workspaceId, potentially breaking tenant isolation in multi-workspace environments.

Flowise is a drag & drop user interface to build customized large language model flows. In versions prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients, creating a security vulnerability.

Flowise versions 3.0.1 to 3.0.8 and all later versions with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and Node VM sandbox escape. An authenticated attacker can use integrated Puppeteer and Playwright modules to execute arbitrary binaries on the host.

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

Flowise versions 2.2.4 through 3.1.4 have a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint, which is in the global authentication whitelist. An unauthenticated attacker can access private files from any chatflow, including those from other organizations.

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation and potentially disrupting dependent OAuth integrations.

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Flowise prior to 3.1.3 does not verify that the Stripe subscriptionId belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing plans or seat quantities.

Flowise prior to 3.1.3 has a vulnerability in the PUT /api/v1/executions/:id endpoint, which lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results.

Flowise prior to 3.1.3 has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. This allows any authenticated user to initiate OAuth2 flows against credentials of other workspaces, and allows unauthenticated attackers to overwrite tokens or refresh tokens for any credential.

Flowise before version 3.1.3 does not scope the upsert history to the requesting user, tenant, or workspace. The response from GET /api/v1/upsert-history can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. Missing authorization, isolation, and pagination expose integration parameters and infrastructure details.

Flowise before version 3.1.3 in openai-assistants-vector-store endpoints accepts a client-controlled credential parameter and loads credentials by id without checking ownership. Route permissions assistants:* only check feature access, and the controller passes req.query.credential to the service, which decrypts and uses it without workspaceId check. An attacker knowing another workspace's credentialId can use that workspace's OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact, and violate multi-tenant boundaries.

Flowise prior to 3.1.3 injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. A user or API key denied variables:view can call /api/v1/node-custom-function and receive all workspace variables, including secrets.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.