SSRF Vulnerability in Flowise Package: Security Bypass Risk
Summary
GHSA-w4hm-rrxg-pxcf: Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability. Affects flowise versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flowise is an open-source tool designed for creating and executing data workflows. It allows users to connect various data sources and automate processes efficiently. However, prior to version 3.1.0, Flowise contained a critical security flaw that exposed it to server-side request forgery (SSRF) attacks, enabling unauthorized access to internal network resources.
Vulnerability Detail
The SSRF vulnerability in Flowise arises from the Execute Flow node, which fails to validate requests properly. Attackers can exploit this flaw by entering intranet addresses in the base URL field, allowing them to send HTTP requests to internal services, access sensitive cloud metadata, and enumerate internal resources. This vulnerability is classified under CWE-918 and poses a moderate risk with a CVSS score of 7.1, indicating potential data exposure and integrity issues.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
npm install flowise@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using intranet addresses in the base URL field and ensure that your application is not exposed to untrusted inputs until the package is updated.
Conclusion
The SSRF vulnerability in Flowise prior to version 3.1.0 poses a significant risk by allowing unauthorized access to internal network resources. It is crucial to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for flowise →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to internal services, exposure of sensitive data, and potential manipulation of internal resources.
Yes, Vulert can monitor your package-lock.json file to alert you in real-time for any open-source vulnerabilities in your software.
If an immediate update is not possible, ensure to restrict the use of intranet addresses and validate all inputs to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
