flowise vulnerabilities (npm)
115 vulnerabilities.
flowisenpmFlowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials8.2 HighflowisenpmFlowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs8.7 HighflowisenpmFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)7.6 HighflowisenpmFlowise: AccountService resetPassword Authentication Bypass Vulnerability7.7 HighflowisenpmFlowise: Cypher Injection in GraphCypherQAChain9.3 CriticalflowisenpmFlowise: Password Reset Link Sent Over Unsecured HTTP7.5 HighflowisenpmFlowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow7.7 HighflowisenpmFlowise: APIChain Prompt Injection SSRF in GET/POST API Chains7.1 HighflowisenpmFlowise: SSRF Protection Bypass (TOCTOU & Default Insecure)7.1 HighflowisenpmFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox7.1 HighflowisenpmFlowise: File Upload Validation Bypass in createAttachment7.1 HighflowisenpmFlowise: Flowise Parameter Override Bypass Remote Command Execution7.7 HighflowisenpmFlowise: Sensitive Data Leak in public-chatbotConfig7.7 HighflowisenpmFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association8.1 HighflowisenpmFlowise: Code Injection in CSVAgent leads to Authenticated RCE9.4 CriticalflowisenpmFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.8.3 HighflowisenpmFlowise - Server-Side Request Forgery via Execute Flow Base URL6.0 MediumflowisenpmFlowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)5.3 MediumflowisenpmFlowise - Path Traversal in Vector Store basePath Parameter4.9 MediumflowisenpmFlowise - Weak Default Token Hash Secret in JWT Token Encryption4.3 MediumflowisenpmFlowise - Session Hijacking via Weak Default Express Session Secret9.3 CriticalflowisenpmFlowise - Weak Default JWT Secrets in Authentication Middleware9.3 CriticalflowisenpmFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint8.7 HighflowisenpmFlowise: Authenticated RCE Via MCP Adapters10.0 CriticalflowisenpmFlowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access7.1 HighflowisenpmFlowise: Missing Authentication on NVIDIA NIM Endpoints7.7 HighflowisenpmFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration8.8 HighflowisenpmFlowise: Mass Assignment in `/api/v1/leads` Endpoint7.7 HighflowisenpmFlowise: Arbitrary File Upload via MIME Spoofing8.2 HighflowisenpmFlowise Authorization Bypass via Spoofed x-request-from Header8.7 HighflowisenpmFlowise - PII Disclosure via Unauthenticated Forgot Password Endpoint6.9 MediumflowisenpmFlowise - Insufficient Password Salt Rounds in Bcrypt Hashing5.6 MediumflowisenpmFlowise - Authentication Bypass via Unprotected Registration Endpoint9.3 CriticalflowisenpmFlowise - Session Invalidation Failure After Password Change8.6 HighflowisenpmFlowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages8.4 HighflowisenpmFlowise is vulnerable to arbitrary file exposure through its ReadFileTool7.7 HighflowisenpmFlowise is vulnerable to arbitrary file read, arbitrary file write10.0 CriticalflowisenpmFlowiseAI/Flosise has File Upload vulnerability8.3 HighflowisenpmFlowise Stored XSS vulnerability through logs in chatbot8.2 HighflowisenpmDuplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel8.2 HighflowisenpmFlowise - Cross-Site Scripting in Chat Messages and Agent Workflows5.1 MediumflowisenpmFlowise - Unsandboxed Remote Code Execution via Custom MCP9.3 CriticalflowisenpmFlowise - Arbitrary File Access via Missing Chat Flow ID Validation9.3 CriticalflowisenpmFlowise - Arbitrary File Read via chatId Parameter8.7 HighflowisenpmFlowise has Remote Code Execution vulnerability10.0 CriticalflowisenpmFlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability7.5 HighflowisenpmFlowiseAI Pre-Auth Arbitrary Code Execution6.5 MediumflowisenpmFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover9.8 CriticalflowisenpmUnsupervised OS command execution leads to remote code execution by unauthenticated network attackers9.8 CriticalflowisenpmUnintended dynamic code execution leads to remote code execution by network attackers9.8 Critical- Show moreLoading…