Flowise vulnerabilities

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint.

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass.

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection.

A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.

Flowise prior to 3.1.3 contains a vulnerability in the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is in WHITELIST_URLS and requires no authentication. An attacker with a credential ID can refresh the OAuth token and gain access to the victim's connected service, as well as exhaust refresh-token quota.

Flowise before version 3.1.3 contains a prompt injection vulnerability in the CSV Agent node, allowing a malicious Python script to bypass the blocklist validator and execute in an unsandboxed Pyodide environment. An attacker can leverage this to execute arbitrary code in the context of the service account.

Flowise prior to 3.1.3 contains a vulnerability in the Python code validator that can be bypassed with Unicode homoglyphs, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host.

Flowise prior to 3.1.3 contains a vulnerability in CSVAgent that allows an attacker to inject code into a Python template executed by Pyodide, enabling arbitrary OS command execution on the Flowise host. An unauthenticated request to the API can trigger remote code execution.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.

Flowise before version 3.1.0 (versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware. When the corresponding environment variables are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators.

Flowise before version 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set. Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

Flowise before version 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature. An attacker can send a crafted JSON payload with the header 'x-request-from: internal' to the /api/v1/node-load-method/customMCP endpoint to execute arbitrary OS commands, leading to complete compromise of the platform container or server.

Flowise before version 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

Flowise through version 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Flowise versions before 2.1.4 allow configuration to be injected into the Chainflow during execution via the overrideConfig option. This feature is enabled by default and lacks a allow-list of permitted variables, enabling attackers to achieve remote code execution and other serious attacks.

A vulnerability in Flowise prior to version 3.1.2 allows an authenticated attacker to achieve remote code execution by submitting arbitrary JavaScript to the Custom JS Function node. Missing authorization on the POST /api/v1/node-custom-function endpoint.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the assistant update endpoint. An authenticated user can modify server-controlled properties such as workspaceId, createdDate, and updatedDate. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces.

In Flowise prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This allows an attacker to perform a brute-force attack on passwords.

In Flowise prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint. An authenticated attacker can modify server-controlled properties such as workspaceId, potentially breaking tenant isolation in multi-workspace environments.

Flowise is a drag & drop user interface to build customized large language model flows. In versions prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients, creating a security vulnerability.

Flowise versions 3.0.1 to 3.0.8 and all later versions with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and Node VM sandbox escape. An authenticated attacker can use integrated Puppeteer and Playwright modules to execute arbitrary binaries on the host.

In Flowise versions prior to 3.0.8, WriteFileTool and ReadFileTool do not restrict file path access, allowing authenticated attackers to read and write arbitrary files to any path, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). The system fails to validate file extensions, MIME types, or file content during uploads. As of time of publication, no known patched versions are available.

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. The vulnerability occurs in the user interface.

Flowise version 3.0.5 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/v1/fetch-links endpoint. An attacker can use the Flowise server as a proxy to access internal network web services and explore their link structures.

In Flowise version 3.0.5 and earlier, the forgot-password endpoint returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to complete account takeover. The vulnerability affects both cloud and self-hosted deployments.

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. This allows an attacker to upload malicious files to the server.

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation.

Flowise (npm packages flowise and flowise-components) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace in several code paths, including getAllOpenaiAssistants/getSingleOpenaiAssistant, uploadFilesToAssistant, deleteAssistant, and the shared helper used by getVoices. An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf.

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When running in queue mode with the dashboard enabled, any authenticated user can access /admin/queues.

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email.

Flowise through 3.1.4 contains an authentication bypass in the SSO login path when an SSO callback arrives with an email matching an INVITED user, allowing takeover of the invitation.

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints, allowing low-privileged API keys to read and delete chat history.

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version.

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints. An authenticated user can supply an unscoped chatflowid to access tools from ChatFlows in other workspaces.

Flowise before 3.1.4 contains a validation bypass in MCP server configuration allowing an authenticated attacker to achieve remote code execution through an unvalidated cwd parameter. The attacker can bypass path validation using clean filenames in the args array while controlling the working directory.

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows an authenticated attacker to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. The attacker can invoke npx with attacker-controlled npm packages.

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. An attacker can add themselves as organization owners, create workspaces, and gain administrative access to victim organizations.

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. An attacker with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

A vulnerability was found in FlowiseAI Flowise up to 3.0.2 affecting the function axios.post in packages/server/src/controllers/evaluations/index.ts of the Evaluations Endpoint component. Manipulation of the Host/X-Forwarded-Proto argument results in server-side request forgery. The attack may be launched remotely and the exploit is public. Upgrading to version 3.1.3 (patch 700137738bcaebefd4709021f6d6b0abcd7df0ac) resolves the issue.

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint, which accepts user-supplied chatflowId and chatId without ownership verification. An attacker can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers.

Flowise versions up to and including 3.1.3 mount the POST /api/v1/node-load-method/:name endpoint without any route-level permission check and invoke component loadMethods with attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace. An authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace, causing Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record, including the bcrypt password hash and temporary tokens. An attacker can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking.