Flowise vulnerabilities

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a valid chatflow UUID, incurring costs on the chatflow owner's account.

Flowise before 3.1.3 contains a remote code execution vulnerability in the Custom MCP node when CUSTOM_MCP_PROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments.

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can enumerate predictable customer IDs to retrieve sensitive information including email addresses, account balances, currency types, and billing configurations without authorization checks.

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques.

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques.

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem.

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), allowing execution of arbitrary OS commands and arbitrary host file disclosure.

Flowise versions 2.2.4 through 3.1.4 have a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint, which is in the global authentication whitelist. An unauthenticated attacker can access private files from any chatflow, including those from other organizations.

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation and potentially disrupting dependent OAuth integrations.

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows.

Flowise prior to 3.1.3 does not verify that the Stripe subscriptionId belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing plans or seat quantities.

Flowise prior to 3.1.3 has a vulnerability in the PUT /api/v1/executions/:id endpoint, which lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results.

Flowise prior to 3.1.3 has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. This allows any authenticated user to initiate OAuth2 flows against credentials of other workspaces, and allows unauthenticated attackers to overwrite tokens or refresh tokens for any credential.

Flowise before version 3.1.3 does not scope the upsert history to the requesting user, tenant, or workspace. The response from GET /api/v1/upsert-history can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. Missing authorization, isolation, and pagination expose integration parameters and infrastructure details.

Flowise before version 3.1.3 in openai-assistants-vector-store endpoints accepts a client-controlled credential parameter and loads credentials by id without checking ownership. Route permissions assistants:* only check feature access, and the controller passes req.query.credential to the service, which decrypts and uses it without workspaceId check. An attacker knowing another workspace's credentialId can use that workspace's OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact, and violate multi-tenant boundaries.

Flowise prior to 3.1.3 injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. A user or API key denied variables:view can call /api/v1/node-custom-function and receive all workspace variables, including secrets.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests with checkAnyPermission('chatflows:delete,agentflows:delete'), so possession of either permission was sufficient to reach the delete path. The delete logic then resolved the target record only by id and workspaceId and did not validate the target resource type, allowing a caller with only agentflows:delete to delete a CHATFLOW and a caller with only chatflows:delete to delete an AGENTFLOW in the same workspace. This issue is fixed in version 3.1.3.

Flowise prior to 3.1.3 contains a vulnerability in the SQLite Record Manager node that allows an authenticated attacker to overwrite the SQLite database path and place malicious syntax in a configuration file, potentially leading to code execution when Chromium is launched.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list. Because ipaddr.js reports these addresses as ipv6 while IPv4 CIDR deny-list entries are ipv4, isDeniedIP() skipped the IPv4 CIDR checks. An attacker who controls DNS resolution for a hostname used by the HTTP Node, API Chain, Document Loader, MCP tool, or other paths using secureAxiosRequest(), secureFetch(), or checkDenyList() could return a AAAA record for an IPv4-mapped target and cause requests to reach localhost, internal services, or cloud metadata endpoints. This issue is fixed in version 3.1.3.

Flowise prior to 3.1.3 contains a vulnerability in the CSVAgent node that allows an authenticated user to execute arbitrary code by deserializing a malicious pickle payload, bypassing the denylist of dangerous Python constructs.

Flowise before version 3.1.3 has a vulnerability in the CSVAgent component where attacker-controlled CSV data is directly interpolated into Python code executed by Pyodide. An authenticated attacker can inject Python code that uses Pyodide's js bridge to load child_process and execute arbitrary system commands as root in the Flowise container.

Flowise before version 3.1.3 has a vulnerability in executeJavaScriptCode() that accepts caller-provided nodeVMOptions and merges them over the default NodeVM security settings. An authenticated attacker can run a custom function that imports utils.js, calls executeJavaScriptCode() with options allowing all built-in modules, and then uses child_process to execute arbitrary system commands as root on the Flowise server.

Flowise before version 3.1.3 has a code injection vulnerability in the AgentAsTool, ChatflowTool, and ExecuteFlow components that run code in the vm2 sandbox. The user-controlled baseURL value is inserted directly into JavaScript code, and the only validation is isValidURL, which does not prevent breaking out of the string. An authenticated user can inject their own JavaScript code, which can escape the sandbox and execute arbitrary code on the Flowise server.

Missing permission check on the /api/v1/files route in Flowise before version 3.1.3, allowing low-privileged API keys to list and delete files across the organization.

Flowise prior to 3.1.3 allows authenticated users to set arbitrary TypeORM DataSource options through the additionalConfig input in several record manager and agent memory nodes. Options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.

Flowise before 3.1.3 has an unauthenticated OAuth2 token refresh endpoint that performs server-side HTTP requests to attacker-controlled URLs without SSRF protections, exposing responses and credentials.

Flowise before version 3.1.0 contains a path traversal vulnerability in the Faiss and SimpleStore vector store implementations. Authenticated users can supply an unsanitized basePath parameter, allowing vector store data to be written to arbitrary filesystem locations.

A vulnerability in Flowise before version 3.1.2 sets the Access-Control-Allow-Origin header to a hardcoded wildcard (*) on the text-to-speech (TTS) generation endpoint. This bypasses the server's configured CORS policy and allows any webpage to make cross-origin requests using stored credentials.

A vulnerability in Flowise before version 3.1.3 allows bypassing the denylist of environment variables for Custom MCP nodes. On Windows, where environment variable names are case-insensitive, using 'node_options' instead of 'NODE_OPTIONS' enables injection of --require options and arbitrary code execution.

Flowise before version 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials.

Flowise before version 3.0.10 has an unverified password change vulnerability. An authenticated user can change their password without providing the current password, allowing an attacker who hijacks a session to take over the account.

Flowise before version 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter.

Flowise before 3.1.0 contains a server-side request forgery (SSRF) vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses and access cloud metadata.

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address without confirming the change to the original email address or re-entering the current password.

Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace that have no API key assigned.

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password hash, establishing persistent account access after temporary session compromise.

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript, leading to cookie and session data theft.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in evaluator create and update that allows cross-workspace evaluator takeover.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in evaluation create and update that allows cross-workspace evaluation takeover.

Flowise prior to version 3.1.2 has a mass-assignment vulnerability in DatasetRow create and update that allows cross-workspace row takeover.

Flowise prior to version 3.1.2 allows cross-workspace dataset takeover via mass-assignment during dataset creation and update. This issue has been patched in version 3.1.2.

Flowise prior to version 3.1.2 allows cross-workspace template takeover via mass-assignment during CustomTemplate creation and update. This issue has been patched in version 3.1.2.

Flowise prior to version 3.1.2 allows cross-workspace assistant takeover via mass-assignment during assistant creation and update. This issue has been patched in version 3.1.2.

Flowise before version 3.1.2 lacks authentication and access control for OpenAI Assistants Vector Store CRUD endpoints. No authorization when using API key.

Flowise prior to version 3.1.2 does not strip the encryptedData field from API responses when fetching credentials with a credentialName filter. Without the filter the field is omitted, but with the filter it is not, leading to leakage of encrypted data.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the chatflow update endpoint. It allows an authenticated user to modify server-controlled properties such as deployed, isPublic, workspaceId, and reassign the resource to another workspace.