GitHub Advisoryadvisory · npm

GHSA-m5p9-xvxj-64c8 Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

MEDIUM Published 2024-09-25 Modified 2024-09-30 Official page ↗
Aliases
CVE-2024-9148
Ecosystem
npm
Packages
flowise-embed, flowise
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2024-09-30

Affected packages

• npm flowise-embed: < 2.0.0 → fixed in 2.0.0 • npm flowise: < 2.1.1 → fixed in 2.1.1

Description

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

Related

Alias · CVE (1)

  • CVE-2024-9148 Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References