AI agent vulnerability · Flowise

GHSA-wq95-wr7m-26h4: Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot

highCVSS 3.1 8.2

This advisory was withdrawn on Oct 8, 2025. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

Published Oct 6, 2025 · Updated Oct 8, 2025

Affected packages

flowise

Ecosystem: npm
Affected: < 3.0.5
Fixed in: 3.0.5
Check: npm ls flowise

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references.

Original Description

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Flowise vulnerabilities

All Flowise entries