Executive brief
Flowise is a platform for building AI agents and workflows visually. The application fails to properly sanitize user input in chat messages and custom function outputs, allowing attackers to inject malicious JavaScript code. When other users view these messages, the injected code executes in their browser and can steal sensitive data like authentication cookies or perform unauthorized actions on their behalf.
Technical details
This is a reflected/stored cross-site scripting (XSS) vulnerability in Flowise caused by insufficient input filtering and output encoding (CWE-79/CWE-80). The vulnerability can be triggered in at least two ways: (1) sending malicious iframe or script tags via chat messages, e.g., `<iframe src="javascript:alert(document.cookie);">`, and (2) creating custom functions that fetch and return unfiltered HTML/JavaScript content from external sources. The attack vector is network-based and requires a low level of privilege (authenticated user) plus user interaction (victims viewing the crafted messages). An attacker can execute arbitrary JavaScript in the context of the victim's browser session, enabling cookie theft, session hijacking, and other client-side attacks. The vulnerability was patched in version 3.0.8; all prior versions including 3.0.5 are affected.
Affected products
- FlowiseAI Flowise before 3.0.8
Timeline
- 2025-10-03: disclosed: GHSA-4fr9-3x69-36wv published
- 2025-10-03: patched: Fix released in version 3.0.8