AI Threat Alert

Flowise Vulnerabilities

npm AI Agents

AI Threat Alert tracks 117 known vulnerabilities in Flowise, 27 rated critical — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
117
Total CVEs
27
Critical
npm
Ecosystem
Jul 8, 2026
Last CVE
43%
Patch Rate
3d
Avg Time to Patch

Known Vulnerabilities (117 total, page 1 of 5)

Severity CVE ID Summary CVSS Published
MEDIUM CVE-2026-56273 Flowise: path traversal in vector store basePath 6.5 Jul 8, 2026 UNKNOWN CVE-2026-56277 Flowise: wildcard CORS on TTS endpoint abuses creds -- Jun 30, 2026 CRITICAL CVE-2026-56278 Flowise: hardcoded default secret enables session forgery 9.1 Jun 30, 2026 MEDIUM CVE-2026-58057 Flowise: NODE_OPTIONS denylist bypass allows RCE 5.0 Jun 28, 2026 CRITICAL CVE-2025-71333 Flowise: unauth file upload + path traversal enables RCE -- Jun 25, 2026 CRITICAL CVE-2025-71336 Flowise: unauthenticated RCE via Custom MCP endpoint 9.8 Jun 25, 2026 HIGH CVE-2025-71335 Flowise: password change fails to revoke sessions 8.1 Jun 25, 2026 CRITICAL CVE-2025-71334 Flowise: path traversal → RCE via missing UUID validation 9.8 Jun 25, 2026 CRITICAL CVE-2025-71338 Flowise: unauthenticated file write enables RCE 10.0 Jun 25, 2026 HIGH CVE-2025-71328 Flowise: unverified password change enables account takeover 8.3 Jun 25, 2026 HIGH CVE-2025-71324 Flowise: path traversal leaks database unauthenticated 7.5 Jun 25, 2026 CRITICAL CVE-2025-71327 Flowise: auth bypass grants full API access 9.1 Jun 25, 2026 HIGH CVE-2026-56270 Flowise: auth bypass exposes OAuth secrets in cleartext 7.5 Jun 24, 2026 MEDIUM CVE-2026-56269 Flowise: hardcoded JWT secret leaks user/workspace IDs 4.6 Jun 24, 2026 MEDIUM CVE-2026-56272 Flowise: weak bcrypt enables 30x faster password cracking 4.1 Jun 24, 2026 MEDIUM CVE-2025-71332 Flowise: SQL injection exposes AI credential store 6.5 Jun 24, 2026 HIGH CVE-2025-34267 Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/para -- Oct 14, 2025 CRITICAL CVE-2026-56274 Flowise: RCE via MCP server command validation bypass 9.9 Jun 23, 2026 UNKNOWN CVE-2026-56275 Flowise: SSRF bypasses security check in Execute Flow -- Jun 23, 2026 HIGH CVE-2025-71337 Flowise: account takeover via unverified email change 8.3 Jun 23, 2026 HIGH CVE-2026-56268 Flowise: cross-workspace chatflow config disclosure 7.7 Jun 22, 2026 MEDIUM CVE-2026-12821 Flowise: path traversal in S3 loader exposes documents 6.3 Jun 21, 2026 MEDIUM CVE-2026-56276 Flowise: mass assignment enables credential hash override -- Jun 20, 2026 MEDIUM CVE-2026-56267 Flowise: PII exposure via unauthenticated password reset -- Jun 20, 2026 MEDIUM CVE-2025-71331 Flowise: XSS enables session hijacking in AI agent UI 6.1 Jun 20, 2026

Showing 1–25 of 117

Next →

Frequently asked questions

What is Flowise?

Flowise is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does Flowise have?

Flowise has 117 known CVEs, 27 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Flowise distributed in?

Flowise is distributed via the npm ecosystem and categorized as ai agents.

Where does the Flowise vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Flowise?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Flowise in your stack

Get instant alerts when new vulnerabilities affect Flowise. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring