AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

FlowiseGHSA-6wp6-22x5-rr3w

Flowise vulnerable to code injection via api/v1

Flowise

CVE-2024-31621 · Published Apr 29, 2024 · updated Aug 2, 2024

High7.6
Fix: upgrade to 1.8.1 or later
GitHub advisory

An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

Affected versions

PackageAffectedFixed in
flowise
npm
< 1.8.11.8.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94
Also known as
CVE-2024-31621

More Flowise advisories

All Flowise
Medium 6.1Aug 5, 2024Flowise Cross-site Scripting in/api/v1/credentials/idCVE-2024-37146no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/public-chatflows/idCVE-2024-36423no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/chatflows-streaming/idCVE-2024-37145no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in api/v1/chatflows/idCVE-2024-36422no fix yetHigh 7.5Aug 5, 2024Flowise Path Injection at /api/v1/openai-assistants-fileCVE-2024-36420no fix yetHigh 7.5Aug 5, 2024Flowise Cors Misconfiguration in packages/server/src/index.tsCVE-2024-36421no fix yet