CVE-2024-31621: Flowise vulnerable to code injection via api/v1
An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
Published Apr 29, 2024 · Updated Aug 2, 2024
Affected packages
flowise
- Ecosystem
- npm
- Affected
- < 1.8.1
- Fixed in
- 1.8.1
- Check
npm ls flowise
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-31621
- https://flowiseai.com
- https://www.exploit-db.com/exploits/52001
- https://github.com/FlowiseAI/Flowise/commit/e32b64344544312bf38b3e1fefe7b26c1776a426
- https://github.com/FlowiseAI/Flowise/blob/flowise%401.6.5/packages/server/src/index.ts#L143-L147
- https://github.com/advisories/GHSA-6wp6-22x5-rr3w
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Flowise vulnerabilities
All Flowise entriesCVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
critical9.4Oct 7, 2026CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
critical9.0Oct 7, 2026CVE-2026-69250
Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
high8.5Aug 4, 2026CVE-2026-69251
Flowise RCE via TypeORM DataSource
critical9.0Aug 4, 2026CVE-2026-69252
Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
high7.2Aug 4, 2026CVE-2026-69253
Flowise Sandbox Escape to RCE
critical9.0Aug 4, 2026