AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

FlowiseGHSA-h997-3fxj-p5j8

Flowise Path Injection at /api/v1/openai-assistants-file

Flowise

CVE-2024-36420 · Published Aug 5, 2024

High7.5
No fix yet
GitHub advisory

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.

Affected versions

PackageAffectedFixed in
flowise
npm
<= 1.4.3No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-74
Also known as
CVE-2024-36420

More Flowise advisories

All Flowise
High 7.3Aug 27, 2024Flowise Authentication Bypass vulnerabilityCVE-2024-8181no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in api/v1/chatflows/idCVE-2024-36422no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/chatflows-streaming/idCVE-2024-37145no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/public-chatflows/idCVE-2024-36423no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in/api/v1/credentials/idCVE-2024-37146no fix yetHigh 7.5Aug 5, 2024Flowise Cors Misconfiguration in packages/server/src/index.tsCVE-2024-36421no fix yet