GitHub Advisoryadvisory · npm
GHSA-6wp6-22x5-rr3w Flowise vulnerable to code injection via api/v1
HIGH
Official page ↗
- Aliases
- CVE-2024-31621
- Ecosystem
- npm
- Packages
- flowise
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- Weaknesses
- CWE-94
- Reviewed
- 2024-08-02
Affected packages
• npm flowise: < 1.8.1 → fixed in 1.8.1
Description
An issue in FlowiseAI Inc Flowise prior to v1.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
Related
Alias · CVE (1)
- CVE-2024-31621 An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-31621 advisory
- https://github.com/FlowiseAI/Flowise/commit/e32b64344544312bf38b3e1fefe7b26c1776a426 web
- https://flowiseai.com web
- https://github.com/FlowiseAI/Flowise package
- https://github.com/FlowiseAI/Flowise/blob/flowise%401.6.5/packages/server/src/index.ts#L143-L147 web
- https://www.exploit-db.com/exploits/52001 web