Quick answers
- Is CVE-2026-30822 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-30822 being exploited in the wild.
- How severe is CVE-2026-30822?
- Low severity, with a CVSS score of 3, published 6 March 2026.
- Which products and versions are affected?
- flowise (npm) SEMVER:introduced=0,fixed=3.0.13.
- Is there a fix for CVE-2026-30822?
- Yes. flowise (npm): upgrade to 3.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-30822 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-30822?
- Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- flowise (npm): upgrade to 3.0.13 or later
npm install flowise@3.0.13
Technical details
A mass assignment vulnerability exists in the POST /api/v1/leads endpoint (CWE-915), where the service uses Object.assign() to copy all properties from user-supplied request body directly into the Lead entity without input validation or field filtering. The vulnerable code at /packages/server/src/services/leads/index.ts lines 27–28 overwrites TypeORM auto-generated fields (@PrimaryGeneratedColumn, @CreateDateColumn) before persistence, allowing attackers to supply custom id, createdDate, and chatId values. The endpoint is whitelisted for unauthenticated access in the WHITELIST_URLS constant. An attacker can craft a POST request with malicious field values and bypass server-side field generation, affecting data integrity and audit logging. The vulnerability was patched in version 3.0.13; versions ≤3.0.12 are affected.
Affected products
- Flowise Flowise ≤3.0.12
Identifiers
- CVE-2026-30822
- GHSA-mq4r-h2gh-qv7x
Timeline
- 2026-03-06: disclosed
- 2026-03-06: patched: Version 3.0.13 released