Flowise vulnerable to code injection via api/v1

ÉLEVÉE 7.6CVE-2024-31621 · GHSA-6wp6-22x5-rr3w · Published 29/04/2024 · updated 17/06/2026

En bref

CVE-2024-31621 est une vulnérabilité ÉLEVÉE (CVSS 7.6) touchant flowise (flowiseai), flowise.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 59.9%, plus élevée que 99.1% des vulnérabilités.
Correctif : mettre à jour vers 1.8.1 ou plus récent.

Package	Affected versions	Patched versions
flowise flowiseai	`≤ 1.6.5`	No fix yet
flowise npm	`< 1.8.1`	`1.8.1`

An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

NVD description

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.6.5

No fix yet

npm

< 1.8.1

1.8.1

Description

An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

NVD description

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

Autres vulnérabilités de flowise

Tout voir →