Executive brief
Flowise is a low-code platform for building AI applications that includes a custom function feature allowing authenticated users to write JavaScript code. An attacker with valid API credentials can bypass the intended SSRF (Server-Side Request Forgery) protection controls and make arbitrary HTTP requests to internal networks, cloud metadata services, and other sensitive endpoints—potentially stealing AWS IAM credentials or accessing internal databases and administrative panels.
Technical details
The vulnerability is an SSRF protection bypass in the Custom Function sandbox implementation. While Flowise protects against SSRF by wrapping axios and node-fetch with an HTTP_DENY_LIST check, the sandbox configuration (packages/components/src/utils.ts, line 56) allows unrestricted access to Node.js built-in modules including http, https, net, dns, and dgram. An authenticated attacker can require() these modules directly and make arbitrary HTTP/DNS requests that circumvent the intended deny-list policy. The attack requires valid API credentials or an authenticated session, and the impact is severe: attackers can steal temporary cloud credentials from metadata services (e.g., AWS IMDSv2), enumerate internal network topology, and access databases or admin panels. Patches are available in Flowise 3.1.0 and flowise-components 3.1.0; versions 3.0.13 and earlier are affected.
Affected products
- FlowiseAI Flowise ≤ 3.0.13
- FlowiseAI flowise-components ≤ 3.0.13
Timeline
- 2026-04-16: disclosed: Published on GitHub Security Advisory
- 2026-04-16: patched: Patched in Flowise 3.1.0 and flowise-components 3.1.0