Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

Flowise

npm

Flowiseai Server

View on npmjs.org

Security Advisories for Flowise in npm

Critical
10 days ago

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service GSA_kwCzR0hTQS1xZ3ZtLWoyaG0tNm0zOM4ABhSo

npm flowise
Critical
10 days ago

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability GSA_kwCzR0hTQS01eHZnLXBtZ2ctM214cs4ABhSn

npm flowise-components, flowise
High
10 days ago

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation GSA_kwCzR0hTQS1nbW13LXFnOTgtNmo2cM4ABhSm

npm flowise
Moderate
10 days ago

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials GSA_kwCzR0hTQS04Z2oyLTJjdmMtNnh4N84ABhSl

npm flowise
High
10 days ago

Flowise: Missing Authorization on Execution Update Endpoint GSA_kwCzR0hTQS1mbTJmLTQzMzktNHAyZs4ABhSk

npm flowise
High
10 days ago

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak GSA_kwCzR0hTQS13Y2g1LXhwNzctZnhnNM4ABhRn

npm flowise
Moderate
10 days ago

Flowise: Incomplete Credential Redaction Exposes Secrets via API GSA_kwCzR0hTQS1yd3JwLTk4MjMtcDJ4cc4ABhRm

npm flowise
High
10 days ago

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history GSA_kwCzR0hTQS1mcjZnLTdjcTgtZmc4Ms4ABhRl

npm flowise
High
10 days ago

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store GSA_kwCzR0hTQS1jaG0zLXZxY2YtNTJyeM4ABhRk

npm flowise
Critical
10 days ago

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation GSA_kwCzR0hTQS00ajh4LXg2djctdzlycc4ABhRj

npm flowise-components, flowise
High
10 days ago

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys GSA_kwCzR0hTQS04OHByLTg3OGMtMjR3Zs4ABhRi

npm flowise, flowise-components
High
10 days ago

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure GSA_kwCzR0hTQS04cjhoLTZ2Y2MteGhyds4ABhRh

npm flowise
Critical
10 days ago

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE GSA_kwCzR0hTQS01MmZoLTh2OTktNjNjMs4ABhRf

npm flowise-components, flowise
High
10 days ago

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) GSA_kwCzR0hTQS14YzQ4LTg4OXgtNXFtd84ABhRe

npm flowise-components, flowise
High
10 days ago

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type GSA_kwCzR0hTQS1wNXc4LW0yNDktNHI0ds4ABhRc

npm flowise
Critical
10 days ago

Flowise RCE via SQLite Record Manager Node GSA_kwCzR0hTQS14M2hmLTdjajYtM3I0bc4ABhRZ

npm flowise
High
10 days ago

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API GSA_kwCzR0hTQS02dmgyLXdnNGgtNHZ3as4ABhRU

npm flowise
High
10 days ago

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses GSA_kwCzR0hTQS1jNnhoLXd2NGotcHB2Nc4ABhRG

npm flowise
Critical
10 days ago

Flowise: Remote Code Execution Vulnerability in CSVAgent GSA_kwCzR0hTQS14NnZtLXc3Nm0tOGo3Z84ABhQd

npm flowise, flowise-components
Critical
10 days ago

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified GSA_kwCzR0hTQS12bXY3LTRtNmMtM2NnNc4ABhQL

npm flowise-components, flowise
Critical
10 days ago

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override GSA_kwCzR0hTQS0zNzY5LWpncWMtY3htN84ABhO-

npm flowise-components, flowise
Critical
10 days ago

Flowise Sandbox Escape to RCE GSA_kwCzR0hTQS13Zzg2LXI3OGYtNzRtcM4ABhMK

npm flowise-components, flowise
High
10 days ago

Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization GSA_kwCzR0hTQS13cDc0LWY1aGgtNWYzcs4ABhLz

npm flowise
Critical
10 days ago

Flowise RCE via TypeORM DataSource GSA_kwCzR0hTQS1nMzJqLW1teHItZ2ZxNc4ABhLy

npm flowise-components, flowise
High
10 days ago

Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration GSA_kwCzR0hTQS1yNzQ1LThod3YtaDQ3M84ABhLx

npm flowise
Moderate
10 days ago

Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint GSA_kwCzR0hTQS0yMzY0LWpoNHEtbTl2bc4ABhLw

npm flowise
Moderate
3 months ago

Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows GSA_kwCzR0hTQS1jMmM5LW1mdzctcDhod84ABXKH

npm flowise
Moderate
3 months ago

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification GSA_kwCzR0hTQS01OWZoLTlmM3AtN20zOc4ABXKG

npm flowise
Moderate
3 months ago

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage GSA_kwCzR0hTQS1tODM3LXh2eHItdnF3Z84ABXKF

npm flowise
High
3 months ago

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover GSA_kwCzR0hTQS13eHJyLWpwOG0tcXE3Zs4ABW33

npm flowise
High
3 months ago

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover GSA_kwCzR0hTQS1tcTUzLXBjNjUtd2pjNM4ABW32

npm flowise
High
3 months ago

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover GSA_kwCzR0hTQS03ajY1LTY1Y3ItNjY0NM4ABW31

npm flowise
High
3 months ago

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover GSA_kwCzR0hTQS01aDl2LTgzN3gtbTk3cs4ABW30

npm flowise
High
3 months ago

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover GSA_kwCzR0hTQS03MjhoLTRtd2otZjJwNM4ABW3z

npm flowise
High
3 months ago

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover GSA_kwCzR0hTQS03OHByLWM1eDUtamdnY84ABW3y

npm flowise
High
3 months ago

FlowiseAI: Vector Store No Permission Checks GSA_kwCzR0hTQS1obWcyLWpqangtamNwMs4ABW3x

npm flowise
High
3 months ago

FlowiseAI Vulnerable to Credential Data Leak GSA_kwCzR0hTQS03ZzczLTk5cjQtbTRtas4ABW2z

npm flowise
Critical
3 months ago

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape GSA_kwCzR0hTQS05cnZjLXZmN20tcGdtMs4ABW2y

npm flowise
High
3 months ago

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment GSA_kwCzR0hTQS1ocDI2LXE2NnYtcTJ3N84ABW2x

npm flowise
High
3 months ago

Flowise has an MCP Security Bypass that Enables RCE GSA_kwCzR0hTQS1tOTlyLTJoeGMtY3Azcc4ABW2w

npm flowise-components, flowise
High
3 months ago

FlowiseAI Exposes Basic Auth Credentials via API GSA_kwCzR0hTQS1waHA2LTgzZmctZ3czZ84ABW2v

npm flowise
High
3 months ago

FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment GSA_kwCzR0hTQS01d3hwLXFqZ3EtZng2bc4ABW2u

npm flowise
High
3 months ago

FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment GSA_kwCzR0hTQS14NXY2LXBqMjgtY3d3bc4ABW2t

npm flowise
High
3 months ago

FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment GSA_kwCzR0hTQS02Znc3LTNxOHItbTV2as4ABW2s

npm flowise
Moderate
3 months ago

Flowise: Bcrypt Password Hash Exposure GSA_kwCzR0hTQS04ZjQ3LTRyaDMteDQ0bc4ABWSL

npm flowise
Critical
4 months ago

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability GSA_kwCzR0hTQS0zaGp2LWM1M20tNThqas4ABViH

npm flowise-components, flowise
Critical
4 months ago

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability GSA_kwCzR0hTQS12Mzh4LWM4ODctOTkyZs4ABVcv

npm flowise-components, flowise
High
4 months ago

Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials GSA_kwCzR0hTQS01ZncyLW13aGgtOTk0N84ABVb3

npm flowise
High
4 months ago

Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs GSA_kwCzR0hTQS13NDdmLWo4cmgtd3g4N84ABVb2

npm flowise
High
4 months ago

Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) GSA_kwCzR0hTQS0zcHJwLTlnZjctNHJ4eM4ABVb1

npm flowise
High
4 months ago

Flowise: resetPassword Authentication Bypass Vulnerability GSA_kwCzR0hTQS1mNmhjLWM1anItODc4cM4ABVZk

npm flowise
High
4 months ago

Flowise: Cypher Injection in GraphCypherQAChain GSA_kwCzR0hTQS0yOGc0LTM4cTgtM2N3Y84ABVZj

npm flowise-components, flowise
High
4 months ago

Flowise: Password Reset Link Sent Over Unsecured HTTP GSA_kwCzR0hTQS14NXc2LTM4Z3AtbXJxaM4ABVZi

npm flowise
High
4 months ago

Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise GSA_kwCzR0hTQS02ZjdnLXY0cHAtcjY2N84ABVZh

npm flowise
High
4 months ago

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains GSA_kwCzR0hTQS02cjc3LWhxeDctN3Z3OM4ABVZg

npm flowise-components, flowise
High
4 months ago

Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) GSA_kwCzR0hTQS0yeDhtLTgzdmMtNnd2NM4ABVZf

npm flowise-components, flowise
High
4 months ago

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox GSA_kwCzR0hTQS14aG1qLXJnOTUtNDRods4ABVZe

npm flowise-components, flowise
High
4 months ago

Flowise: File Upload Validation Bypass in createAttachment GSA_kwCzR0hTQS1yaDd2LTZ3MzQtdzJycs4ABVZd

npm flowise
High
4 months ago

Flowise: Parameter Override Bypass Remote Command Execution GSA_kwCzR0hTQS1jdnJyLXFoZ3ctMm1tNs4ABVZc

npm flowise-components, flowise
High
4 months ago

Flowise: Sensitive Data Leak in public-chatbotConfig GSA_kwCzR0hTQS00anBtLWNneDItOGgzN84ABVZb

npm flowise
High
4 months ago

Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association GSA_kwCzR0hTQS00OG02LWNoODgtNTVtas4ABVZa

npm flowise
Critical
4 months ago

Flowise: Code Injection in CSVAgent leads to Authenticated RCE GSA_kwCzR0hTQS05d2M3LW1qM2YtNzR4ds4ABVZZ

npm flowise-components, flowise
High
4 months ago

Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. GSA_kwCzR0hTQS1mMjI4LWNobXgtdjZqNs4ABVZY

npm flowise-components, flowise
Moderate
4 months ago

Flowise Execute Flow function has an SSRF vulnerability GSA_kwCzR0hTQS05aHJ2LWd2cnYtNmdmMs4ABVZB

npm flowise-components, flowise
Moderate
4 months ago

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) GSA_kwCzR0hTQS1xcXZtLTY2cTQtdmY1Y84ABVZA

npm flowise-components, flowise
Moderate
4 months ago

Flowise: Path Traversal in Vector Store basePath GSA_kwCzR0hTQS13NnY2LTQ5Z2gtbWM5d84ABVY_

npm flowise-components, flowise
Moderate
4 months ago

Flowise: Weak Default Token Hash Secret GSA_kwCzR0hTQS1tN21xLTg1eGotOXgzM84ABVY-

npm flowise
Moderate
4 months ago

Flowise: Weak Default Express Session Secret GSA_kwCzR0hTQS0ycXFjLXA5NGMtaHh3aM4ABVY9

npm flowise
Moderate
4 months ago

Flowise: Weak Default JWT Secrets GSA_kwCzR0hTQS1jYzRmLWhqcGotZzlwOM4ABVY8

npm flowise
Moderate
4 months ago

Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request GSA_kwCzR0hTQS02cGN2LWo0angtbTR2eM4ABVY7

npm flowise
Critical
4 months ago

Flowise: Authenticated RCE Via MCP Adapters GSA_kwCzR0hTQS1jOWd3LWh2cXEtZjMzcs4ABVY5

npm flowise-components, flowise
High
5 months ago

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access GSA_kwCzR0hTQS1mdmN3LTl3OXItcHhjN84ABTcJ

npm flowise
High
5 months ago

Flowise Missing Authentication on NVIDIA NIM Endpoints GSA_kwCzR0hTQS01ZjUzLTUyMmotajQ1NM4ABTSO

npm flowise
High
5 months ago

Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration GSA_kwCzR0hTQS1jd2MzLXA5MmotZzdxbc4ABTSN

npm flowise
High
5 months ago

Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint GSA_kwCzR0hTQS1tcTRyLWgyZ2gtcXY3eM4ABTSM

npm flowise
High
5 months ago

Flowise has Arbitrary File Upload via MIME Spoofing GSA_kwCzR0hTQS1qOGc4LWo3ZmMtNDN2Ns4ABTSD

npm flowise
High
5 months ago

Flowise has Authorization Bypass via Spoofed x-request-from Header GSA_kwCzR0hTQS13dmhxLXdwOGctYzd2cc4ABTSC

npm flowise
Moderate
5 months ago

Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint GSA_kwCzR0hTQS1qYzVtLXdycDItcXEzOM4ABTQD

npm flowise
Moderate
5 months ago

Flowise has Insufficient Password Salt Rounds GSA_kwCzR0hTQS14Mmc1LWZ2YzItZ3F2cM4ABTQC

npm flowise
High
9 months ago

Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register) GSA_kwCzR0hTQS12NXc5LXByeGYtdzg4Ms4ABOm_

npm flowise
High
9 months ago

Flowise Fails to Invalidate Existing Sessions After Password Changes GSA_kwCzR0hTQS14N3JwLXFqMmgtZ2hnd84ABOju

npm flowise
High
10 months ago

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages GSA_kwCzR0hTQS1yNGhoLXBjZ3gtajVyMs4ABNaj

npm flowise
High
10 months ago

Flowise is vulnerable to arbitrary file exposure through its ReadFileTool GSA_kwCzR0hTQS1qNDRtLTV2OGYtZ2M5Y84ABNQ-

npm flowise-components, flowise
Critical
10 months ago

Flowise is vulnerable to arbitrary file write through its WriteFileTool GSA_kwCzR0hTQS1qdjltLXZmNTQtY2hqas4ABNKD

npm flowise-components, flowise
High
10 months ago

FlowiseAI/Flosise has File Upload vulnerability GSA_kwCzR0hTQS0zNWc2LXJydzMtdjZ4Y84ABNIu

npm flowise
Critical
10 months ago

Flowise vulnerable to RCE via Dynamic function constructor injection GSA_kwCzR0hTQS1obWdoLTQ2NmotZng0Y84ABM_s

npm flowise
Moderate
10 months ago

Flowise Stored XSS vulnerability through logs in chatbot GSA_kwCzR0hTQS03cjRoLXZtajktd2c0Ms4ABM7h

npm flowise
Critical
10 months ago

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel GSA_kwCzR0hTQS05NjRwLWo0Z2ctbWh3Y84ABM7g

npm flowise
Moderate
10 months ago

Flowise vulnerable to XSS GSA_kwCzR0hTQS00ZnI5LTN4NjktMzZ3ds4ABM6z

npm flowise
High
11 months ago

Flowise has unsandboxed remote code execution via Custom MCP GSA_kwCzR0hTQS02OTMzLWpweDUtcTg3cc4ABMIl

npm flowise
Critical
11 months ago

Flowise has arbitrary file access due to missing chat flow id validation GSA_kwCzR0hTQS1xNjdxLTU0OXEtcDg0Oc4ABMIk

npm flowise
Critical
11 months ago

Flowise has an Arbitrary File Read GSA_kwCzR0hTQS05OXBnLWhxdngtcjRnZs4ABMIj

npm flowise
Critical
11 months ago

Flowise has Remote Code Execution vulnerability GSA_kwCzR0hTQS0zZ2NtLWY2cXgtZmY3cM4ABMIi

npm flowise
High
11 months ago

FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability GSA_kwCzR0hTQS1ocjkyLTRxMzUtNGozbc4ABMIh

npm flowise
Critical
11 months ago

FlowiseAI Pre-Auth Arbitrary Code Execution GSA_kwCzR0hTQS03OTQ0LTdjNnItNTV2ds4ABMIg

npm flowise
Critical
11 months ago

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover GSA_kwCzR0hTQS13Z3B2LTZqNjMteDVwaM4ABMB8

npm flowise
Critical
12 months ago

Flowise OS command remote code execution GSA_kwCzR0hTQS0ydnYyLTN4OHgtNGd2N84ABLD2

npm flowise
Moderate
over 1 year ago

FlowiseDB vulnerable to SQL Injection by authenticated users GSA_kwCzR0hTQS05YzRjLWc5NW0tYzhjcM4ABGhA

npm flowise
Critical
over 1 year ago

Flowise allows arbitrary file write to RCE GSA_kwCzR0hTQS04dnZ4LXF2cTktNTk0OM4ABFfO

npm flowise
Critical
over 1 year ago

Flowise Pre-auth Arbitrary File Upload GSA_kwCzR0hTQS1oNDJ4LXh4MnEtNnY2Z84ABFbt

npm flowise

Filter by Severity

High 62 Critical 26 Moderate 24