AI agent vulnerability · Flowise

CVE-2024-9148: Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

mediumCVSS 4.0 5.8 · 3.1 9.6GHSA-m5p9-xvxj-64c8

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

Published Sep 25, 2024 · Updated Sep 30, 2024

Affected packages

flowise-embed

Ecosystem: npm
Affected: < 2.0.0
Fixed in: 2.0.0
Check: npm ls flowise-embed

flowise

Ecosystem: npm
Affected: < 2.1.1
Fixed in: 2.1.1
Check: npm ls flowise

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Flowise vulnerabilities

All Flowise entries