Flowise is officially being sunset and will soon cease active maintenance or support. As a result, we are no longer accepting new security vulnerability reports for this repository. You can find more information here.
This repository was archived by the owner on Aug 13, 2026. It is now read-only.
Repository navigation
Security: FlowiseAI/Flowise
Security
SECURITY.md
-
DatasetRow create+update mass-assignment allows cross-workspace row takeoverGHSA-7j65-65cr-6644 published
May 14, 2026 by igor-magun-wdHigh -
CustomTemplate create+update mass-assignment allows cross-workspace template takeoverGHSA-728h-4mwj-f2p4 published
May 14, 2026 by igor-magun-wdHigh -
Assistant create+update mass-assignment allows cross-workspace assistant takeoverGHSA-78pr-c5x5-jggc published
May 14, 2026 by igor-magun-wdHigh -
Cross-workspace credential IDOR in node-load-method allows low-privilege users to enumerate victim third-party resourcesGHSA-hqvm-7539-v83j published
Aug 28, 2026 by igor-magun-wdModerate -
Flowise Custom MCP npx package execution leads to authenticated server-side command executionGHSA-vcwp-f9rq-3887 published
Aug 31, 2026 by igor-magun-wdCritical -
INVITED users auto-promoted via SSO email match (invite-token bypass)GHSA-vf3j-89vf-r697 published
Sep 10, 2026 by igor-magun-wdCritical -
Cross-IdP account takeover via email-only SSO matchingGHSA-cffm-583c-vffr published
Sep 10, 2026 by igor-magun-wdCritical -
BullMQ dashboard `/admin/queues` is auth-only (no RBAC), exposing cross-tenant job payloads to every authenticated userGHSA-rpcc-gw54-mfgx published
Sep 10, 2026 by igor-magun-wdHigh -
Rce viaCSVAgent csvFile data URI base64 segment is interpolated into Python source without validation,GHSA-4j8x-x6v7-w9rq published
Jul 29, 2026 by igor-magun-wdCritical -
Flowise RCE via SQLite Record Manager NodeGHSA-x3hf-7cj6-3r4m published
Jul 29, 2026 by igor-magun-wdCritical
Learn more about advisories related to FlowiseAI/Flowise in the GitHub Advisory Database