Is flowise safe?
17 unfixed advisories Facts from the mcp-audit registry about the npm package flowise. The same data is served as JSON.
Check it from your terminal
mcp-audit vet flowiseOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | FlowiseAI |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-08-22 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/FlowiseAI/Flowise |
Recorded advisories 114
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2024-36420 | not recorded | Flowise Path Injection at /api/v1/openai-assistants-file | no fix recorded |
| CVE-2024-36421 | not recorded | Flowise Cors Misconfiguration in packages/server/src/index.ts | no fix recorded |
| CVE-2024-36422 | not recorded | Flowise Cross-site Scripting in api/v1/chatflows/id | no fix recorded |
| CVE-2024-36423 | not recorded | Flowise Cross-site Scripting in /api/v1/public-chatflows/id | no fix recorded |
| CVE-2024-37145 | not recorded | Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id | no fix recorded |
| CVE-2024-37146 | not recorded | Flowise Cross-site Scripting in/api/v1/credentials/id | no fix recorded |
| CVE-2024-8181 | not recorded | Flowise Authentication Bypass vulnerability | no fix recorded |
| CVE-2024-8182 | not recorded | Flowise Unauthenticated Denial of Service (DoS) vulnerability | no fix recorded |
| CVE-2025-26319 | not recorded | FlowiseAI Flowise arbitrary file upload vulnerability | no fix recorded |
| CVE-2025-55346 | not recorded | Flowise vulnerable to RCE via Dynamic function constructor injection | no fix recorded |
| CVE-2025-71327 | not recorded | Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register) | no fix recorded |
| CVE-2025-71332 | not recorded | FlowiseDB vulnerable to SQL Injection by authenticated users | no fix recorded |
| CVE-2025-71333 | not recorded | Flowise Pre-auth Arbitrary File Upload | no fix recorded |
| CVE-2025-71338 | not recorded | Flowise allows arbitrary file write to RCE | no fix recorded |
| CVE-2025-8943 | not recorded | Flowise OS command remote code execution | no fix recorded |
| CVE-2026-8026 | not recorded | Flowise: Bcrypt Password Hash Exposure | no fix recorded |
| CVE-2025-59528 | not recorded | no summary recorded | no fix recorded |
| CVE-2024-31621 | not recorded | Flowise vulnerable to code injection via api/v1 | 1.8.1 |
| CVE-2024-58351 | not recorded | Flowise OverrideConfig security vulnerability | 2.1.4 |
| CVE-2024-9148 | not recorded | Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting | 2.1.1 |
| CVE-2025-29192 | not recorded | Flowise Stored XSS vulnerability through logs in chatbot | 3.0.5 |
| CVE-2025-34267 | not recorded | Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages | 3.0.8 |
| CVE-2025-50538 | not recorded | Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel | 3.0.8 |
| CVE-2025-57164 | not recorded | FlowiseAI Pre-Auth Arbitrary Code Execution | 3.0.6 |
| CVE-2025-58434 | not recorded | Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover | 3.0.6 |
| CVE-2025-59527 | not recorded | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | 3.0.6 |
| CVE-2025-61687 | not recorded | FlowiseAI/Flosise has File Upload vulnerability | 3.0.8 |
| CVE-2025-61913 | not recorded | Flowise is vulnerable to arbitrary file write through its WriteFileTool | 3.0.8 |
| CVE-2025-71324 | not recorded | Flowise has an Arbitrary File Read | 3.0.6 |
| CVE-2025-71331 | not recorded | Flowise vulnerable to XSS | 3.0.8 |
| CVE-2025-71334 | not recorded | Flowise has arbitrary file access due to missing chat flow id validation | 3.0.6 |
| CVE-2025-71335 | not recorded | Flowise Fails to Invalidate Existing Sessions After Password Changes | 3.0.10 |
| CVE-2025-71336 | not recorded | Flowise has unsandboxed remote code execution via Custom MCP | 3.0.6 |
| CVE-2026-30820 | not recorded | Flowise has Authorization Bypass via Spoofed x-request-from Header | 3.0.13 |
| CVE-2026-30821 | not recorded | Flowise has Arbitrary File Upload via MIME Spoofing | 3.0.13 |
| CVE-2026-30822 | not recorded | Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint | 3.0.13 |
| CVE-2026-30823 | not recorded | Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration | 3.0.13 |
| CVE-2026-30824 | not recorded | Flowise Missing Authentication on NVIDIA NIM Endpoints | 3.0.13 |
| CVE-2026-31829 | not recorded | Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access | 3.0.13 |
| CVE-2026-40933 | not recorded | Flowise: Authenticated RCE Via MCP Adapters | 3.1.0 |
| CVE-2026-41137 | not recorded | Flowise: Code Injection in CSVAgent leads to Authenticated RCE | 3.1.0 |
| CVE-2026-41138 | not recorded | Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. | 3.1.0 |
| CVE-2026-41264 | not recorded | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | 3.1.0 |
| CVE-2026-41265 | not recorded | Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability | 3.1.0 |
| CVE-2026-41266 | not recorded | Flowise: Sensitive Data Leak in public-chatbotConfig | 3.1.0 |
| CVE-2026-41267 | not recorded | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association | 3.1.0 |
| CVE-2026-41268 | not recorded | Flowise: Parameter Override Bypass Remote Command Execution | 3.1.0 |
| CVE-2026-41269 | not recorded | Flowise: File Upload Validation Bypass in createAttachment | 3.1.0 |
| CVE-2026-41270 | not recorded | Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox | 3.1.0 |
| CVE-2026-41271 | not recorded | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | 3.1.0 |
| CVE-2026-41272 | not recorded | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | 3.1.0 |
| CVE-2026-41273 | not recorded | Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise | 3.1.0 |
| CVE-2026-41274 | not recorded | Flowise: Cypher Injection in GraphCypherQAChain | 3.1.0 |
| CVE-2026-41275 | not recorded | Flowise: Password Reset Link Sent Over Unsecured HTTP | 3.1.0 |
| CVE-2026-41276 | not recorded | Flowise: resetPassword Authentication Bypass Vulnerability | 3.1.0 |
| CVE-2026-41277 | not recorded | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) | 3.1.0 |
| CVE-2026-41278 | not recorded | Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs | 3.1.0 |
| CVE-2026-41279 | not recorded | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials | 3.1.0 |
| CVE-2026-42861 | not recorded | FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment | 3.1.2 |
| CVE-2026-42862 | not recorded | FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment | 3.1.2 |
| CVE-2026-42863 | not recorded | FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment | 3.1.2 |
| CVE-2026-43995 | not recorded | Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) | 3.1.0 |
| CVE-2026-46440 | not recorded | FlowiseAI Exposes Basic Auth Credentials via API | 3.1.2 |
| CVE-2026-46441 | not recorded | FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment | 3.1.2 |
| CVE-2026-46442 | not recorded | FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape | 3.1.2 |
| CVE-2026-46443 | not recorded | FlowiseAI Vulnerable to Credential Data Leak | 3.1.2 |
| CVE-2026-46444 | not recorded | FlowiseAI: Vector Store No Permission Checks | 3.1.2 |
| CVE-2026-46475 | not recorded | FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover | 3.1.2 |
| CVE-2026-46476 | not recorded | FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover | 3.1.2 |
| CVE-2026-46477 | not recorded | FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover | 3.1.2 |
| CVE-2026-46478 | not recorded | FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover | 3.1.2 |
| CVE-2026-46479 | not recorded | FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover | 3.1.2 |
| CVE-2026-46480 | not recorded | FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover | 3.1.2 |
| CVE-2026-56267 | not recorded | Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint | 3.0.13 |
| CVE-2026-56268 | not recorded | Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows | 3.1.2 |
| CVE-2026-56269 | not recorded | Flowise: Weak Default Token Hash Secret | 3.1.0 |
| CVE-2026-56270 | not recorded | Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request | 3.1.0 |
| CVE-2026-56271 | not recorded | Flowise: Weak Default JWT Secrets | 3.1.0 |
| CVE-2026-56272 | not recorded | Flowise has Insufficient Password Salt Rounds | 3.0.13 |
| CVE-2026-56273 | not recorded | Flowise: Path Traversal in Vector Store basePath | 3.1.0 |
| CVE-2026-56274 | not recorded | Flowise has an MCP Security Bypass that Enables RCE | 3.1.2 |
| CVE-2026-56275 | not recorded | Flowise Execute Flow function has an SSRF vulnerability | 3.1.0 |
| CVE-2026-56276 | not recorded | Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification | 3.1.2 |
| CVE-2026-56277 | not recorded | Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage | 3.1.2 |
| CVE-2026-56278 | not recorded | Flowise: Weak Default Express Session Secret | 3.1.0 |
| CVE-2026-69250 | not recorded | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | 3.1.3 |
| CVE-2026-69251 | not recorded | Flowise RCE via TypeORM DataSource | 3.1.3 |
| CVE-2026-69252 | not recorded | Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization | 3.1.3 |
| CVE-2026-69253 | not recorded | Flowise Sandbox Escape to RCE | 3.1.3 |
| CVE-2026-69254 | not recorded | Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override | 3.1.3 |
| CVE-2026-69255 | not recorded | Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified | 3.1.3 |
| CVE-2026-69256 | not recorded | Flowise: Remote Code Execution Vulnerability in CSVAgent | 3.1.3 |
| CVE-2026-69257 | not recorded | Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses | 3.1.3 |
| CVE-2026-69258 | not recorded | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API | 3.1.3 |
| CVE-2026-69259 | not recorded | Flowise RCE via SQLite Record Manager Node | 3.1.3 |
| CVE-2026-69262 | not recorded | Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type | 3.1.3 |
| CVE-2026-69263 | not recorded | Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) | 3.1.3 |
| CVE-2026-69264 | not recorded | Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation | 3.1.3 |
| CVE-2026-70470 | not recorded | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE | 3.1.3 |
| CVE-2026-70471 | not recorded | Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure | 3.1.3 |
| CVE-2026-70472 | not recorded | Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store | 3.1.3 |
| CVE-2026-70473 | not recorded | Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history | 3.1.3 |
| CVE-2026-70474 | not recorded | Flowise: Cross-Workspace OAuth2 Credential Metadata Leak | 3.1.3 |
| CVE-2026-70475 | not recorded | Flowise: Missing Authorization on Execution Update Endpoint | 3.1.3 |
| CVE-2026-70476 | not recorded | Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation | 3.1.3 |
| CVE-2026-70477 | not recorded | Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability | 3.1.3 |
| CVE-2026-70478 | not recorded | Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service | 3.1.3 |
| CVE-2026-73483 | not recorded | Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium | 3.1.3 |
| CVE-2026-73487 | not recorded | Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass | 3.1.3 |
| CVE-2026-73488 | not recorded | Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint | 3.1.3 |
| CVE-2026-73603 | not recorded | Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials | 3.1.4 |
| CVE-2026-73604 | not recorded | Flowise: Incomplete Credential Redaction Exposes Secrets via API | 3.1.3 |
| GHSA-88pr-878c-24wf | not recorded | Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys | 3.1.3 |
| GHSA-j44m-5v8f-gc9c | not recorded | Flowise is vulnerable to arbitrary file exposure through its ReadFileTool | 3.0.8 |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can make outbound network requests.
- It can execute shell commands.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit17 unfixed CVEs
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/npm/flowise/)