flowise (npm)
Advisories
121
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.1.4 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install flowise@3.1.4yarn
yarn add flowise@3.1.4pnpm
pnpm add flowise@3.1.4Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6j9g-8fxc-25hq Duplicate Advisory: Flowise contains an unauthenticated sandbox escape Withdrawn |
High | < 3.1.3 | 3.1.3 |
| GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass |
Critical EPSS 0.96% |
< 3.1.3 | 3.1.3 |
| GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium |
High EPSS 0.62% |
< 3.1.3 | 3.1.3 |
| GHSA-qgvm-j2hm-6m38 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service |
Critical EPSS 0.61% |
< 3.1.3 | 3.1.3 |
| GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability |
Critical EPSS 0.81% |
< 3.1.3 | 3.1.3 |
| GHSA-gmmw-qg98-6j6p Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation |
High EPSS 0.52% |
< 3.1.3 | 3.1.3 |
| GHSA-8gj2-2cvc-6xx7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials |
Medium EPSS 0.33% |
< 3.1.4 | 3.1.4 |
| GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint |
Medium EPSS 0.46% |
< 3.1.3 | 3.1.3 |
| GHSA-wch5-xp77-fxg4 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak |
High EPSS 0.48% |
< 3.1.3 | 3.1.3 |
| GHSA-rwrp-9823-p2xq Flowise: Incomplete Credential Redaction Exposes Secrets via API |
High EPSS 0.41% |
< 3.1.3 | 3.1.3 |
| GHSA-fr6g-7cq8-fg82 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history |
High EPSS 0.45% |
< 3.1.3 | 3.1.3 |
| GHSA-chm3-vqcf-52rx Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store |
High EPSS 0.52% |
< 3.1.3 | 3.1.3 |
| GHSA-4j8x-x6v7-w9rq Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation |
Critical EPSS 1.11% |
< 3.1.3 | 3.1.3 |
| GHSA-88pr-878c-24wf Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys |
High | < 3.1.3 | 3.1.3 |
| GHSA-8r8h-6vcc-xhrv Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure |
Medium EPSS 0.41% |
< 3.1.3 | 3.1.3 |
| GHSA-52fh-8v99-63c2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE |
Critical EPSS 0.97% |
< 3.1.3 | 3.1.3 |
| GHSA-xc48-889x-5qmw Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) |
Critical EPSS 0.66% |
< 3.1.3 | 3.1.3 |
| GHSA-p5w8-m249-4r4v Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type |
High EPSS 0.52% |
< 3.1.3 | 3.1.3 |
| GHSA-x3hf-7cj6-3r4m Flowise RCE via SQLite Record Manager Node |
High EPSS 0.82% |
< 3.1.3 | 3.1.3 |
| GHSA-6vh2-wg4h-4vwj Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API |
Critical EPSS 0.67% |
< 3.1.3 | 3.1.3 |
| GHSA-c6xh-wv4j-ppv5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses |
High EPSS 0.43% |
< 3.1.3 | 3.1.3 |
| GHSA-x6vm-w76m-8j7g Flowise: Remote Code Execution Vulnerability in CSVAgent |
High EPSS 1.01% |
< 3.1.3 | 3.1.3 |
| GHSA-vmv7-4m6c-3cg5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified |
High EPSS 0.60% |
< 3.1.3 | 3.1.3 |
| GHSA-3769-jgqc-cxm7 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override |
High EPSS 0.69% |
< 3.1.3 | 3.1.3 |
| GHSA-wg86-r78f-74mp Flowise Sandbox Escape to RCE |
High EPSS 0.66% |
< 3.1.3 | 3.1.3 |
| GHSA-wp74-f5hh-5f3r Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization |
High EPSS 0.54% |
< 3.1.3 | 3.1.3 |
| GHSA-g32j-mmxr-gfq5 Flowise RCE via TypeORM DataSource |
High EPSS 2.74% |
< 3.1.3 | 3.1.3 |
| GHSA-r745-8hwv-h473 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration |
High EPSS 0.57% |
< 3.1.3 | 3.1.3 |
| GHSA-2364-jh4q-m9vm Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint |
Medium EPSS 0.37% |
< 3.1.3 | 3.1.3 |
| GHSA-w4hm-rrxg-pxcf Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability Withdrawn |
High | < 3.1.0 | 3.1.0 |
| GHSA-5w6g-rc45-wvv9 Duplicate Advisory: Flowise OverrideConfig security vulnerability Withdrawn |
Critical | < 2.1.4 | 2.1.4 |
| GHSA-c2c9-mfw7-p8hw Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows |
High EPSS 0.39% |
< 3.1.2 | 3.1.2 |
| GHSA-59fh-9f3p-7m39 Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification |
Medium EPSS 0.37% |
< 3.1.2 | 3.1.2 |
| GHSA-m837-xvxr-vqwg Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage |
Medium EPSS 0.18% |
< 3.1.2 | 3.1.2 |
| GHSA-wxrr-jp8m-qq7f FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-mq53-pc65-wjc4 FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-7j65-65cr-6644 FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-5h9v-837x-m97r FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-728h-4mwj-f2p4 FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-78pr-c5x5-jggc FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover |
High EPSS 0.34% |
< 3.1.2 | 3.1.2 |
| GHSA-hmg2-jjjx-jcp2 FlowiseAI: Vector Store No Permission Checks |
High EPSS 0.33% |
< 3.1.2 | 3.1.2 |
| GHSA-7g73-99r4-m4mj FlowiseAI Vulnerable to Credential Data Leak |
Medium EPSS 0.27% |
< 3.1.2 | 3.1.2 |
| GHSA-9rvc-vf7m-pgm2 FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape |
Critical EPSS 36.34% |
< 3.1.2 | 3.1.2 |
| GHSA-hp26-q66v-q2w7 FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment |
Critical EPSS 0.27% |
< 3.1.2 | 3.1.2 |
| GHSA-m99r-2hxc-cp3q Flowise has an MCP Security Bypass that Enables RCE |
Critical EPSS 7.52% |
< 3.1.2 | 3.1.2 |
| GHSA-php6-83fg-gw3g FlowiseAI Exposes Basic Auth Credentials via API |
Critical EPSS 0.25% |
< 3.1.2 | 3.1.2 |
| GHSA-5wxp-qjgq-fx6m FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment |
High EPSS 0.32% |
< 3.1.2 | 3.1.2 |
| GHSA-x5v6-pj28-cwwm FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment |
Medium EPSS 0.19% |
< 3.1.2 | 3.1.2 |
| GHSA-6fw7-3q8r-m5vj FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment |
Critical EPSS 0.25% |
< 3.1.2 | 3.1.2 |
| GHSA-8f47-4rh3-x44m Flowise: Bcrypt Password Hash Exposure |
Medium EPSS 0.26% |
<= 3.0.12 | No fix yet |
| GHSA-3hjv-c53m-58jj Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability |
Critical EPSS 1.79% |
< 3.1.0 | 3.1.0 |
| GHSA-v38x-c887-992f Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability |
Critical EPSS 0.57% |
< 3.1.0 | 3.1.0 |
| GHSA-5fw2-mwhh-9947 Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials |
High EPSS 0.26% |
< 3.1.0 | 3.1.0 |
| GHSA-w47f-j8rh-wx87 Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs |
High EPSS 0.42% |
< 3.1.0 | 3.1.0 |
| GHSA-3prp-9gf7-4rxx Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) |
High EPSS 3.11% |
< 3.1.0 | 3.1.0 |
| GHSA-f6hc-c5jr-878p Flowise: resetPassword Authentication Bypass Vulnerability |
Critical EPSS 6.87% |
< 3.1.0 | 3.1.0 |
| GHSA-28g4-38q8-3cwc Flowise: Cypher Injection in GraphCypherQAChain |
Critical EPSS 0.51% |
< 3.1.0 | 3.1.0 |
| GHSA-x5w6-38gp-mrqh Flowise: Password Reset Link Sent Over Unsecured HTTP |
High EPSS 0.18% |
< 3.1.0 | 3.1.0 |
| GHSA-6f7g-v4pp-r667 Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise |
High EPSS 0.31% |
< 3.1.0 | 3.1.0 |
| GHSA-6r77-hqx7-7vw8 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains |
High EPSS 0.23% |
< 3.1.0 | 3.1.0 |
| GHSA-2x8m-83vc-6wv4 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) |
High EPSS 0.26% |
< 3.1.0 | 3.1.0 |
| GHSA-xhmj-rg95-44hv Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox |
High EPSS 0.23% |
< 3.1.0 | 3.1.0 |
| GHSA-rh7v-6w34-w2rr Flowise: File Upload Validation Bypass in createAttachment |
High EPSS 0.47% |
< 3.1.0 | 3.1.0 |
| GHSA-cvrr-qhgw-2mm6 Flowise: Parameter Override Bypass Remote Command Execution |
Critical EPSS 17.44% |
< 3.1.0 | 3.1.0 |
| GHSA-4jpm-cgx2-8h37 Flowise: Sensitive Data Leak in public-chatbotConfig |
High EPSS 4.06% |
< 3.1.0 | 3.1.0 |
| GHSA-48m6-ch88-55mj Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association |
Critical EPSS 0.33% |
< 3.1.0 | 3.1.0 |
| GHSA-9wc7-mj3f-74xv Flowise: Code Injection in CSVAgent leads to Authenticated RCE |
High EPSS 1.45% |
< 3.1.0 | 3.1.0 |
| GHSA-f228-chmx-v6j6 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. |
High EPSS 0.60% |
< 3.1.0 | 3.1.0 |
| GHSA-9hrv-gvrv-6gf2 Flowise Execute Flow function has an SSRF vulnerability |
High EPSS 0.32% |
< 3.1.0 | 3.1.0 |
| GHSA-qqvm-66q4-vf5c Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) |
Critical EPSS 0.40% |
< 3.1.0 | 3.1.0 |
| GHSA-w6v6-49gh-mc9w Flowise: Path Traversal in Vector Store basePath |
Medium EPSS 0.50% |
< 3.1.0 | 3.1.0 |
| GHSA-m7mq-85xj-9x33 Flowise: Weak Default Token Hash Secret |
Medium EPSS 0.13% |
< 3.1.0 | 3.1.0 |
| GHSA-2qqc-p94c-hxwh Flowise: Weak Default Express Session Secret |
Critical EPSS 0.53% |
< 3.1.0 | 3.1.0 |
| GHSA-cc4f-hjpj-g9p8 Flowise: Weak Default JWT Secrets |
Critical EPSS 0.66% |
< 3.1.0 | 3.1.0 |
| GHSA-6pcv-j4jx-m4vx Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request |
High EPSS 2.05% |
< 3.1.0 | 3.1.0 |
| GHSA-c9gw-hvqq-f33r Flowise: Authenticated RCE Via MCP Adapters |
Critical EPSS 11.96% |
< 3.1.0 | 3.1.0 |
| GHSA-fvcw-9w9r-pxc7 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access |
High EPSS 2.44% |
< 3.0.13 | 3.0.13 |
| GHSA-5f53-522j-j454 Flowise Missing Authentication on NVIDIA NIM Endpoints |
Critical EPSS 36.91% |
< 3.0.13 | 3.0.13 |
| GHSA-cwc3-p92j-g7qm Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration |
High EPSS 0.44% |
< 3.0.13 | 3.0.13 |
| GHSA-mq4r-h2gh-qv7x Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint |
High EPSS 13.43% |
< 3.0.13 | 3.0.13 |
| GHSA-j8g8-j7fc-43v6 Flowise has Arbitrary File Upload via MIME Spoofing |
Critical EPSS 15.24% |
< 3.0.13 | 3.0.13 |
| GHSA-wvhq-wp8g-c7vq Flowise has Authorization Bypass via Spoofed x-request-from Header |
High EPSS 0.50% |
< 3.0.13 | 3.0.13 |
| GHSA-jc5m-wrp2-qq38 Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint |
Medium EPSS 0.46% |
< 3.0.13 | 3.0.13 |
| GHSA-x2g5-fvc2-gqvp Flowise has Insufficient Password Salt Rounds |
Medium EPSS 0.10% |
< 3.0.13 | 3.0.13 |
| GHSA-v5w9-prxf-w882 Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register) |
Critical EPSS 0.68% |
No fix yet | |
| GHSA-x7rp-qj2h-ghgw Flowise Fails to Invalidate Existing Sessions After Password Changes |
High EPSS 0.38% |
< 3.0.10 | 3.0.10 |
| GHSA-3g4j-r53p-22wx Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution Withdrawn |
Critical | >= 3.0.5, < 3.0.6 | 3.0.6 |
| GHSA-r4hh-pcgx-j5r2 Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages |
Critical EPSS 6.56% |
>= 3.0.1, < 3.0.8 | 3.0.8 |
| GHSA-j44m-5v8f-gc9c Flowise is vulnerable to arbitrary file exposure through its ReadFileTool |
High EPSS 13.87% |
< 3.0.8 | 3.0.8 |
| GHSA-jv9m-vf54-chjj Flowise is vulnerable to arbitrary file write through its WriteFileTool |
Critical EPSS 13.87% |
< 3.0.8 | 3.0.8 |
| GHSA-35g6-rrw3-v6xc FlowiseAI/Flosise has File Upload vulnerability |
High EPSS 11.76% |
>= 3.0.7, < 3.0.8 | 3.0.8 |
| GHSA-wq95-wr7m-26h4 Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot Withdrawn |
High | < 3.0.5 | 3.0.5 |
| GHSA-7rgr-72hp-9wp3 Duplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel Withdrawn |
High | < 3.0.5 | 3.0.5 |
| GHSA-7r4h-vmj9-wg42 Flowise Stored XSS vulnerability through logs in chatbot |
Medium EPSS 0.41% |
< 3.0.5 | 3.0.5 |
| GHSA-964p-j4gg-mhwc Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel |
Medium EPSS 14.71% |
< 3.0.8 | 3.0.8 |
| GHSA-4fr9-3x69-36wv Flowise vulnerable to XSS |
Medium EPSS 0.33% |
< 3.0.8 | 3.0.8 |
| GHSA-6933-jpx5-q87q Flowise has unsandboxed remote code execution via Custom MCP |
Critical EPSS 1.15% |
>= 2.2.7-patch.1, < 3.0.6 | 3.0.6 |
| GHSA-q67q-549q-p849 Flowise has arbitrary file access due to missing chat flow id validation |
Critical EPSS 4.36% |
>= 2.2.8, < 3.0.6 | 3.0.6 |
| GHSA-99pg-hqvx-r4gf Flowise has an Arbitrary File Read |
High EPSS 1.57% |
>= 3.0.5, < 3.0.6 | 3.0.6 |
| GHSA-3gcm-f6qx-ff7p Flowise has Remote Code Execution vulnerability |
Critical EPSS 86.49% |
>= 3.0.5, < 3.0.6 | 3.0.6 |
| GHSA-hr92-4q35-4j3m FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability |
High EPSS 5.46% |
>= 3.0.5, < 3.0.6 | 3.0.6 |
| GHSA-7944-7c6r-55vv FlowiseAI Pre-Auth Arbitrary Code Execution |
Medium EPSS 0.64% |
>= 3.0.5, < 3.0.6 | 3.0.6 |
| GHSA-wgpv-6j63-x5ph Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover |
Critical EPSS 76.45% |
< 3.0.6 | 3.0.6 |
| GHSA-q4xx-mc3q-23x8 Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection Withdrawn |
Critical | <= 3.0.5 | No fix yet |
| GHSA-2vv2-3x8x-4gv7 Flowise OS command remote code execution |
Critical EPSS 75.20% |
<= 3.0.5 | No fix yet |
| GHSA-hmgh-466j-fx4c Flowise vulnerable to RCE via Dynamic function constructor injection |
Critical EPSS 22.54% |
<= 2.2.7-patch.1 | No fix yet |
| GHSA-9c4c-g95m-c8cp FlowiseDB vulnerable to SQL Injection by authenticated users |
High EPSS 0.52% |
<= 2.2.7 | No fix yet |
| GHSA-8vvx-qvq9-5948 Flowise allows arbitrary file write to RCE |
Critical EPSS 1.16% |
<= 2.2.7 | No fix yet |
| GHSA-h42x-xx2q-6v6g Flowise Pre-auth Arbitrary File Upload |
Critical EPSS 0.90% |
<= 2.2.7 | No fix yet |
| GHSA-69jq-qr7w-j7qh FlowiseAI Flowise arbitrary file upload vulnerability |
Critical EPSS 55.87% |
<= 2.2.6 | No fix yet |
| GHSA-5cph-wvm9-45gj Flowise OverrideConfig security vulnerability |
Critical EPSS 0.93% |
< 2.1.4 | 2.1.4 |
| GHSA-m5p9-xvxj-64c8 Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.56% |
< 2.1.1 | 2.1.1 |
| GHSA-48x4-mx8f-gr4h Flowise Unauthenticated Denial of Service (DoS) vulnerability |
High EPSS 13.89% |
<= 1.8.2 | No fix yet |
| GHSA-2q4w-x8h2-2fvh Flowise Authentication Bypass vulnerability |
High EPSS 45.05% |
<= 1.8.2 | No fix yet |
| GHSA-wxm4-9f8p-gggv Flowise Cross-site Scripting in/api/v1/credentials/id |
Medium EPSS 0.40% |
<= 1.4.3 | No fix yet |
| GHSA-858c-qxvx-rg9v Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id |
Medium EPSS 0.46% |
<= 1.4.3 | No fix yet |
| GHSA-fccx-2pwj-hrq7 Flowise Cross-site Scripting in /api/v1/public-chatflows/id |
Medium EPSS 0.40% |
<= 1.4.3 | No fix yet |
| GHSA-2jch-qc96-9f5g Flowise Cross-site Scripting in api/v1/chatflows/id |
Medium EPSS 0.41% |
<= 1.4.3 | No fix yet |
| GHSA-66f2-xxgm-f6xp Flowise Cors Misconfiguration in packages/server/src/index.ts |
High EPSS 8.49% |
<= 1.4.3 | No fix yet |
| GHSA-h997-3fxj-p5j8 Flowise Path Injection at /api/v1/openai-assistants-file |
High EPSS 1.78% |
<= 1.4.3 | No fix yet |
| GHSA-6wp6-22x5-rr3w Flowise vulnerable to code injection via api/v1 |
High EPSS 59.87% |
< 1.8.1 | 1.8.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor