CVE-2025-55346: Flowise JS Injection Remote Code Execution Vulnerability
Summary
CVE-2025-55346: Flowise JS injection remote code execution. Affects flowise versions < 3.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flowise is an open-source JavaScript package designed for building and deploying machine learning workflows. It allows users to create complex data processing pipelines with ease. However, due to its reliance on user input for dynamic code execution, it is vulnerable to code injection attacks, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from user-controlled input being passed to an unsafe implementation of a dynamic Function constructor. This flaw allows network attackers to execute arbitrary unsandboxed JavaScript code in the context of the host application by sending a simple POST request. The implications of this vulnerability are critical, as it can lead to unauthorized access, data breaches, and complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs and avoid using dynamic code execution methods until you can update the package. Implement input validation to ensure that only expected data types and formats are processed.
Conclusion
CVE-2025-55346 is a critical vulnerability in the Flowise package that poses significant security risks due to its potential for remote code execution. It is essential to update to the patched version to safeguard your application. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for flowise →
FAQ
CVE-2025-55346 is a critical vulnerability in the Flowise package that allows remote code execution through JavaScript injection.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
Exploitation of this vulnerability can lead to unauthorized code execution, data breaches, and potential takeover of the affected system.
Yes, a patch is available. Update to Flowise version 3.0.6 or later to mitigate the vulnerability.
If immediate updating is not possible, implement input validation and sanitization as a temporary measure to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
