flowise@2.1.0 vulnerabilities

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the creation of a chatflow. An attacker can bypass input filters by providing a snippet without an event handler as input to a conversation, like <iframe src=javascript:console.log(document.domain)>. This input is passed on to the administration panel and executed.

Upgrade flowise to version 2.1.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the /api/v1/get-upload-file API endpoint. An attacker can cause the application to crash by sending specially crafted input.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/public-chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the /api/v1/chatflows-streaming/id, which returns a 404 page in the absence of a streaming ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/credentials/id endpoint, which returns a 404 page in the absence of a credential ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the api/v1/chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Path Traversal due to improper sanitization of the filename parameter used by the /api/v1/openai-assistants-file endpoint. An attacker can pass in a path traversal string to read arbitrary files on the vulnerable file system.

There is no fixed version for flowise.