npm / flowise

Flowise: Cypher Injection in GraphCypherQAChain

수정: 2026. 5. 5.

Flowise Cross-site Scripting in api/v1/chatflows/id

수정: 2024. 8. 5.

Flowise Authentication Bypass vulnerability

수정: 2024. 9. 4.

Flowise: Weak Default Express Session Secret

수정: 2026. 4. 16.

Flowise OS command remote code execution

수정: 2025. 8. 18.

Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

수정: 2026. 5. 5.

FlowiseAI/Flosise has File Upload vulnerability

수정: 2025. 12. 16.

Flowise has Remote Code Execution vulnerability

수정: 2025. 10. 13.

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

수정: 2026. 5. 5.

Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)

수정: 2026. 5. 5.

Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

수정: 2026. 5. 5.

Flowise Unauthenticated Denial of Service (DoS) vulnerability

수정: 2024. 8. 27.

Flowise vulnerable to XSS

수정: 2025. 10. 13.

Flowise: Sensitive Data Leak in public-chatbotConfig

수정: 2026. 5. 5.

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

수정: 2026. 5. 20.

Flowise OverrideConfig security vulnerability

수정: 2024. 11. 21.

Flowise Missing Authentication on NVIDIA NIM Endpoints

수정: 2026. 3. 9.

Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials

수정: 2026. 5. 5.

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

수정: 2026. 6. 9.

FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

수정: 2026. 6. 9.

Flowise Cors Misconfiguration in packages/server/src/index.ts

수정: 2024. 8. 5.

Flowise has unsandboxed remote code execution via Custom MCP

수정: 2025. 9. 15.

FlowiseAI Flowise arbitrary file upload vulnerability

수정: 2025. 3. 5.

Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise

수정: 2026. 5. 5.

FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

수정: 2026. 6. 9.

Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request

수정: 2026. 4. 16.

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

수정: 2026. 5. 5.

Flowise vulnerable to code injection via api/v1

수정: 2024. 8. 2.

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

수정: 2026. 6. 9.

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

수정: 2026. 6. 9.

FlowiseAI Pre-Auth Arbitrary Code Execution

수정: 2025. 10. 17.

FlowiseAI Vulnerable to Credential Data Leak

수정: 2026. 6. 9.

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

수정: 2026. 6. 9.

Flowise Stored XSS vulnerability through logs in chatbot

수정: 2026. 3. 14.

Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id

수정: 2024. 8. 5.

Flowise: Bcrypt Password Hash Exposure

수정: 2026. 5. 12.

Flowise allows arbitrary file write to RCE

수정: 2025. 3. 14.

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

수정: 2026. 2. 4.

Flowise has an Arbitrary File Read

수정: 2025. 9. 15.

FlowiseDB vulnerable to SQL Injection by authenticated users

수정: 2025. 4. 7.

Flowise Execute Flow function has an SSRF vulnerability

수정: 2026. 4. 16.

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

수정: 2026. 6. 9.

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

수정: 2026. 5. 5.

Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

수정: 2026. 5. 20.

Flowise: Authenticated RCE Via MCP Adapters

수정: 2026. 4. 16.

Flowise: Weak Default JWT Secrets

수정: 2026. 4. 16.

Flowise: Parameter Override Bypass Remote Command Execution

수정: 2026. 5. 5.

Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

수정: 2026. 3. 9.

Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

수정: 2026. 5. 5.

Flowise: resetPassword Authentication Bypass Vulnerability

수정: 2026. 5. 5.

Flowise Cross-site Scripting in /api/v1/public-chatflows/id

수정: 2024. 8. 5.

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

수정: 2026. 4. 10.

Flowise Pre-auth Arbitrary File Upload

수정: 2025. 3. 13.

Flowise Path Injection at /api/v1/openai-assistants-file

수정: 2024. 8. 5.

FlowiseAI: Vector Store No Permission Checks

수정: 2026. 6. 11.

Flowise vulnerable to RCE via Dynamic function constructor injection

수정: 2025. 10. 6.

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

수정: 2026. 6. 9.

FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability

수정: 2025. 9. 22.

Flowise is vulnerable to arbitrary file exposure through its ReadFileTool

수정: 2026. 2. 4.

Flowise has Arbitrary File Upload via MIME Spoofing

수정: 2026. 3. 9.

Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint

수정: 2026. 3. 5.

Flowise is vulnerable to arbitrary file write through its WriteFileTool

수정: 2026. 2. 4.

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

수정: 2024. 9. 30.

Flowise: Weak Default Token Hash Secret

수정: 2026. 4. 16.

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

수정: 2026. 5. 20.

Flowise has an MCP Security Bypass that Enables RCE

수정: 2026. 5. 16.

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

수정: 2026. 3. 9.

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

수정: 2026. 6. 9.

FlowiseAI Exposes Basic Auth Credentials via API

수정: 2026. 6. 9.

Flowise has arbitrary file access due to missing chat flow id validation

수정: 2025. 9. 15.

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

수정: 2026. 5. 13.

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

수정: 2025. 10. 29.

Flowise: File Upload Validation Bypass in createAttachment

수정: 2026. 5. 5.

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

수정: 2026. 5. 5.

Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)

수정: 2025. 11. 17.

Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs

수정: 2026. 5. 5.

Flowise: Path Traversal in Vector Store basePath

수정: 2026. 4. 16.

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

수정: 2025. 9. 15.

Flowise has Authorization Bypass via Spoofed x-request-from Header

수정: 2026. 3. 9.

Flowise Cross-site Scripting in/api/v1/credentials/id

수정: 2024. 8. 5.

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

수정: 2026. 6. 9.

Flowise has Insufficient Password Salt Rounds

수정: 2026. 3. 5.

FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

수정: 2026. 6. 9.

Flowise: Password Reset Link Sent Over Unsecured HTTP

수정: 2026. 5. 5.

Flowise Fails to Invalidate Existing Sessions After Password Changes

수정: 2025. 11. 14.

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

수정: 2026. 5. 5.