Flowise vulnerable to code injection via api/v1

ALTO 7.6CVE-2024-31621 · GHSA-6wp6-22x5-rr3w · Published 29/04/2024 · updated 17/06/2026

In breve

CVE-2024-31621 è una vulnerabilità ALTO (CVSS 7.6) che riguarda flowise (flowiseai), flowise.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 59.9%, superiore al 99.1% delle vulnerabilità.
Correzione: aggiornare a 1.8.1 o successiva.

Package	Affected versions	Patched versions
flowise flowiseai	`≤ 1.6.5`	No fix yet
flowise npm	`< 1.8.1`	`1.8.1`

An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

NVD description

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.6.5

No fix yet

npm

< 1.8.1

1.8.1

Description

An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

NVD description

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

Altre vulnerabilità di flowise

Vedi tutto →