This repository was archived by the owner on Aug 13, 2026. It is now read-only.
Security: FlowiseAI/Flowise
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeGHSA-9rvc-vf7m-pgm2 published
May 14, 2026 by igor-magun-wdCritical -
Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIGHSA-6vh2-wg4h-4vwj published
Jul 29, 2026 by igor-magun-wdHigh -
Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationGHSA-gmmw-qg98-6j6p published
Jul 29, 2026 by igor-magun-wdHigh -
Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change VerificationGHSA-59fh-9f3p-7m39 published
May 14, 2026 by igor-magun-wdModerate -
Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource ReassignmentGHSA-6fw7-3q8r-m5vj published
May 14, 2026 by igor-magun-wdHigh -
Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentGHSA-hp26-q66v-q2w7 published
May 14, 2026 by igor-magun-wdHigh -
Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentGHSA-x5v6-pj28-cwwm published
May 14, 2026 by igor-magun-wdHigh -
Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow ReassignmentGHSA-5wxp-qjgq-fx6m published
May 14, 2026 by igor-magun-wdHigh -
RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureGHSA-8r8h-6vcc-xhrv published
Jul 29, 2026 by igor-magun-wdHigh -
Flowise Execute Flow function has an SSRF vulnerabilityGHSA-9hrv-gvrv-6gf2 published
Apr 15, 2026 by igor-magun-wdModerate