AI agent vulnerability · Flowise

CVE-2024-36420: Flowise Path Injection at /api/v1/openai-assistants-file

highCVSS 4.0 8.7 · 3.1 7.5GHSA-h997-3fxj-p5j8

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.

Published Aug 5, 2024

Affected packages

flowise

Ecosystem: npm
Affected: <= 1.4.3
Fixed in: No patched version yet
Check: npm ls flowise

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Flowise vulnerabilities

All Flowise entries