Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. flowise
  4. ›
  5. GHSA-7r4h-vmj9-wg42

GHSA-7r4h-vmj9-wg42: Flowise Stored XSS vulnerability through logs in chatbot

October 3, 2025

In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin’s credentials or sensitive information with stored Cross Site Scripting.

References

  • github.com/FlowiseAI/Flowise
  • github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42
  • github.com/advisories/GHSA-7r4h-vmj9-wg42

Code Behaviors & Features

Detect and mitigate GHSA-7r4h-vmj9-wg42 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 3.0.7

Solution

Unfortunately, there is no solution available yet.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Source file

npm/flowise/GHSA-7r4h-vmj9-wg42.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 06 Oct 2025 00:18:25 +0000.