GHSA-5cph-wvm9-45gj CVE-2024-58351

Flowise OverrideConfig security vulnerability

Critical npm

Severity: 0.0 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 0.93%; Chance of exploitation in the next 30 days. Higher than 60.48% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-15 External Control of System or Configuration Setting
Fix: 2.1.4; Upgrade flowise to this version or later

Description

Impact

Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API.

This has a range of fundamental issues that are a major security vulnerability. While this feature is intentional, it should have strong protections added and be disabled by default.

These issues include:

Remote code execution. While inside a sandbox this allows for
Sandbox escape
DoS by crashing the server
SSRF
Prompt Injection, both System and User
Full control over LLM prompts
Server variable and data exfiltration And many many more such as altering the flow of a conversation, prompt exfiltration via LLM proxying etc.

These issues are self-targeted and do not persist to other users but do leave the server and business exposed. All issues are shown with the API but also work with the web embed.

Workarounds

overrideConfig should be disabled by default
overrideConfig should have an explicit allow list of variables that are allowed to be modified. This way the user opts-in to where modifications can be made.
vm2 and any forks of it should be removed as in the authors own words, "fixing the vulnerability seems impossible". The recommended replacement is https://www.npmjs.com/package/isolated-vm

Affected versions

npm

Package	Vulnerable	Fixed in
flowise	`< 2.1.4`	`2.1.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

flowise npm → `2.1.4`

npm

npm install flowise@2.1.4

yarn

yarn add flowise@2.1.4

pnpm

pnpm add flowise@2.1.4

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-15: External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Implementation, Architecture and Design: Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.
Implementation, Architecture and Design: In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-58351

Packages

github.com/FlowiseAI/Flowise

Timeline

Nov 21, 2024 Published
Oct 27, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass	Critical	Also affects flowise
GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium	High	Also affects flowise
GHSA-qgvm-j2hm-6m38 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service	Critical	Also affects flowise
GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability	Critical	Also affects flowise
GHSA-gmmw-qg98-6j6p Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation	High	Also affects flowise
GHSA-8gj2-2cvc-6xx7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials	Medium	Also affects flowise
GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint	Medium	Also affects flowise
GHSA-wch5-xp77-fxg4 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak	High	Also affects flowise

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor