Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Flowise

CVE-2025-29189: Flowise Vulnerable to SQL Injection via `tableName` Parameter

highCVSS 3.1 7.6GHSA-gjx9-wg9x-7gvp

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores.

Published Apr 9, 2025 · Updated Apr 10, 2025

Affected packages

flowise-components

Ecosystem
npm
Affected
<= 2.2.3
Fixed in
2.2.4
Check
npm ls flowise-components

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Flowise vulnerabilities

All Flowise entries