Flowise Vulnerable to SQL Injection via `tableName` Parameter

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-29189 · ADVISORY
• FlowiseAI/Flowise#3818 · WEB
• FlowiseAI/Flowise commit 9a417bd · WEB
• drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view · WEB
• FlowiseAI/Flowise · PACKAGE

Autres vulnérabilités de flowise

• CVE-2026-90580MOYENNE 6.3A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/s…
• CVE-2026-90535ÉLEVÉE 7.5Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that a…
• CVE-2026-90534MOYENNE 6.5Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name…
• CVE-2026-90533MOYENNE 6.5Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organizati…
• CVE-2026-52098CRITIQUE 9.8An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint