flowise@1.8.4 vulnerabilities

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the creation of a chatflow. An attacker can bypass input filters by providing a snippet without an event handler as input to a conversation, like <iframe src=javascript:console.log(document.domain)>. This input is passed on to the administration panel and executed.

Upgrade flowise to version 2.1.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the /api/v1/get-upload-file API endpoint. An attacker can cause the application to crash by sending specially crafted input.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Improper Authentication via the API endpoint authentication process. An attacker can gain unauthorized administrative access and manipulate restricted functionalities by bypassing the authentication mechanism.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/public-chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the /api/v1/chatflows-streaming/id, which returns a 404 page in the absence of a streaming ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/credentials/id endpoint, which returns a 404 page in the absence of a credential ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the api/v1/chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Path Traversal due to improper sanitization of the filename parameter used by the /api/v1/openai-assistants-file endpoint. An attacker can pass in a path traversal string to read arbitrary files on the vulnerable file system.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Origin Validation Error due to the use of the Access-Control-Allow-Origin header being set to allow all origins by default. An attacker can expose information by making requests from unauthorized origins.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper input validation in the api/v1 component. An attacker can execute arbitrary code by sending a crafted script.

Upgrade flowise to version 2.0.6 or higher.