Executive brief
Flowise is an open-source low-code platform for building AI workflows. A server-side request forgery (SSRF) vulnerability in the Cheerio, Playwright, and Puppeteer document loader nodes allows attackers to bypass security controls and access sensitive cloud metadata, internal services, and private network resources. An attacker can specify arbitrary URLs that the application fetches and returns the response content as document text, potentially exposing AWS credentials and other confidential data.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the document loader nodes (Cheerio, Playwright, and Puppeteer) that fails to implement the SSRF protection mechanisms (checkDenyList() and secureFetch) already present in other API loaders. The vulnerable code instantiates LangChain's built-in loader classes directly with user-supplied URLs without validation, allowing these loaders to make unauthenticated HTTP requests outside Flowise's security layer. An attacker with the ability to create or modify a chatflow can provide arbitrary URLs (such as http://169.254.169.254/latest/meta-data/) to extract cloud metadata and internal service responses. The vulnerability affects Flowise and flowise-components versions up to and including 3.1.3; versions 3.1.4 and later include the fix by adding checkDenyList() calls before instantiating the loaders.
Affected products
- FlowiseAI Flowise before 3.1.4
- FlowiseAI flowise-components before 3.1.4
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-9cvr-5wv9-2gxr published
- 2026-09-15: advisory: CVE-2026-91938 published on NVD
- 2026-08-31: patched: Patch available in version 3.1.4