flowiseai flowise-components Vulnerabilities: CVEs, CISA KEV & Security Advisories

flowiseai flowise-components Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every flowiseai flowise-components version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 3.1.011 CVEs
< 2.2.41 CVE
< 3.0.131 CVE
< 3.0.81 CVE

Fixed in

3.1.011 CVEs
2.2.41 CVE
3.0.131 CVE
3.0.81 CVE

Find a version

14 CVEs

Sort

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
CVE-2026-43995
Public exploit
Patch
CWE-918
Medium · CVSS 5.3
EPSS 0.4% (32th pct)2026-05-11
Flowise: Cypher Injection in GraphCypherQAChain
CVE-2026-41274
Public exploit
Patch
CWE-943
Critical · CVSS 9.3
EPSS 0.5% (40th pct)2026-04-23
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
CVE-2026-41264
Public exploit
Patch
CWE-184
Critical · CVSS 9.2
EPSS 1.4% (70th pct)2026-04-23
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
CVE-2026-41265
Public exploit
Patch
CWE-77
Critical · CVSS 9.2
EPSS 0.5% (38th pct)2026-04-23
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
CVE-2026-41271
Public exploit
Patch
CWE-918
High · CVSS 8.3
EPSS 0.2% (14th pct)2026-04-23
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
CVE-2026-41272
Public exploit
Patch
CWE-918
High · CVSS 7.1
EPSS 0.2% (14th pct)2026-04-23
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
CVE-2026-41270
Public exploit
Patch
CWE-918
High · CVSS 7.4
EPSS 0.2% (15th pct)2026-04-23
Flowise: Flowise Parameter Override Bypass Remote Command Execution
CVE-2026-41268
Public exploit
Patch
CWE-20
Critical · CVSS 9.8
EPSS 13.8% (96th pct)2026-04-23
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
CVE-2026-41137
Public exploit
Patch
CWE-94
Critical · CVSS 9.4
EPSS 1.5% (71th pct)2026-04-23
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.
CVE-2026-41138
Public exploit
Patch
CWE-94
High · CVSS 8.8
EPSS 0.6% (45th pct)2026-04-23
Flowise: Authenticated RCE Via MCP Adapters
CVE-2026-40933
Public exploit
Patch
CWE-78
Critical · CVSS 10.0
EPSS 13.4% (96th pct)2026-04-21
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
CVE-2026-31829
Public exploit
Patch
CWE-918
High · CVSS 8.8
EPSS 2.3% (82th pct)2026-03-10
Flowise is vulnerable to arbitrary file read, arbitrary file write
CVE-2025-61913
Public exploit
Patch
CWE-22
Critical · CVSS 10.0
EPSS 12.1% (96th pct)2025-10-08
High vulnerability · 2025-04-09
CVE-2025-29189
Public exploit
Patch
CWE-89
High · CVSS 7.6
EPSS 0.3% (21th pct)2025-04-09