VulertSecurity VulertSecurity

Vulnerability Database · npm · flowise · Version

flowise 2.0.7

2.0.7 is affected by 109 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.1.4.

Critical 26 High 59 Medium 24 Low 0 Unrated 0

All flowise versions & vulnerabilities → Search the database for this package →
Released 28 Aug 2024 Licence non-standard Also known from other sources 96 Newer releases 104 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

flowise 2.0.7 vulnerabilities

109 vulnerabilities cover flowise 2.0.7. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Critical Remote Code Execution Vulnerability in Flowise Package 10.0 critical No fix published 14 Mar 2025
CVE-2026-40933: Flowise Authenticated RCE via MCP Adapters 9.9 critical 3.1.0 16 Apr 2026
CVE-2025-61913: Flowise Arbitrary File Write Vulnerability 9.9 critical 3.0.8 09 Oct 2025
Critical Remote Code Execution Vulnerability in Flowise Package 9.8 critical 2.1.4 20 Jun 2026
CVE-2025-55346: Flowise Vulnerable to Remote Code Execution via Dynamic Function Constructor Injection 9.8 critical No fix published 06 Oct 2025
CVE-2025-58434: Flowise Unauthenticated Password Reset Token Disclosure Leading to Account Takeover 9.8 critical 3.0.5 12 Sep 2025
CVE-2025-8943: Flowise Remote Code Execution Vulnerability Due to Lack of Authentication 9.8 critical No fix published 14 Aug 2025
CVE-2025-55346: Flowise JS Injection Remote Code Execution Vulnerability 9.8 critical No fix published 14 Aug 2025
CVE-2026-70477: Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability 9.5 critical 3.1.3 04 Aug 2026
CVE-2026-70470: Flowise Unicode Homoglyph Bypass Leading to Remote Code Execution 9.5 critical 3.1.3 04 Aug 2026
CVE-2026-73483: Flowise NodeVM Sandbox Escape Leading to Authenticated RCE and Arbitrary File Read 9.4 critical 3.1.3 07 Oct 2026
CVE-2026-69264: Flowise Remote Code Execution via CSVAgent Data URI Injection 9.4 critical 3.1.3 04 Aug 2026
CVE-2026-69259: Flowise RCE via SQLite Record Manager Node 9.4 critical 3.1.3 04 Aug 2026
CVE-2026-69254: Flowise Remote Code Execution via NodeVM Sandbox Escape 9.4 critical 3.1.3 04 Aug 2026
Critical Remote Code Execution Vulnerability in FlowiseAI 9.4 critical 3.1.2 14 May 2026
Critical Code Injection Vulnerability in Flowise Packages Leading to Remote Code Execution 9.4 critical 3.1.0 16 Apr 2026
Critical Stored XSS Vulnerability in Flowise Package Allows Credential Theft 9.3 critical 2.2.7-patch.1 03 Oct 2025
Critical Pre-auth Arbitrary File Upload Vulnerability in Flowise 9.3 critical No fix published 13 Mar 2025
CVE-2026-70478: Flowise Unauthenticated OAuth2 Token Refresh Endpoint Vulnerability 9.2 critical 3.1.3 04 Aug 2026
CVE-2026-69255: Flowise CSV Agent Remote Code Execution via Pyodide Code Injection 9.2 critical 3.1.3 04 Aug 2026
CVE-2026-41264: FlowiseAI Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability 9.2 critical 3.1.0 21 Apr 2026
Critical Remote Code Execution Vulnerability in Flowise Package 9.2 critical 3.1.0 18 Apr 2026
CVE-2026-73487: Flowise Critical Vulnerability Leading to RCE and SSRF via Prompt Injection 9.0 critical 3.1.3 07 Oct 2026
CVE-2026-69253: Flowise Package Vulnerability Leading to Remote Code Execution 9.0 critical 3.1.3 04 Aug 2026
CVE-2026-69251: Flowise RCE via TypeORM DataSource - Critical Remote Code Execution Vulnerability 9.0 critical 3.1.3 04 Aug 2026
Arbitrary File Upload Vulnerability in FlowiseAI Flowise v2.2.6 8.9 high No fix published 05 Mar 2025
Critical Sandbox Escape Vulnerability in Flowise and Flowise-Components 8.8 critical 3.1.3 13 Aug 2026
CVE-2026-69258: Flowise Unauthenticated Property Injection Vulnerability 8.8 high 3.1.3 04 Aug 2026
CVE-2026-30823: Flowise IDOR Vulnerability Leading to Account Takeover and Feature Bypass 8.8 high 3.0.13 06 Mar 2026
CVE-2026-69263: Flowise Unauthenticated RCE via npm_config_yes Bypass 8.7 high 3.1.3 04 Aug 2026
Unauthorized Access in Flowise: OpenAI Assistants Vector Store Vulnerability 8.7 high 3.1.2 14 May 2026
Remote Code Execution Vulnerability in Flowise: MCP Security Bypass 8.7 high 3.1.2 14 May 2026
Sensitive Data Exposure in Flowise: Public Chatflow Endpoints Leak API Keys and Credentials 8.7 high 3.1.0 17 Apr 2026
CVE-2026-30820: Flowise Authorization Bypass via Spoofed x-request-from Header 8.7 high 3.0.13 06 Mar 2026
Authentication Bypass Vulnerability in Flowise 3.0.1 via Unprotected Registration Endpoint 8.7 high No fix published 17 Nov 2025
Critical Security Flaw in Flowise: Remote Code Execution and Data Exfiltration Risks 8.6 high 2.1.4 21 Nov 2024
CVE-2026-69250: Flowise Unauthenticated OAuth2 Refresh Vulnerability Leading to SSRF and Secret Exfiltration 8.5 high 3.1.3 04 Aug 2026
CVE-2026-70476: Flowise Cross-Tenant Billing Manipulation via Broken Access Control 8.3 high 3.1.3 04 Aug 2026
CVE-2026-70473: Flowise High Severity Information Disclosure via Upsert History Endpoint 8.3 high 3.1.3 04 Aug 2026
Remote Code Execution Vulnerability in Flowise Packages: AirtableAgent Exploit 8.3 high 3.1.0 16 Apr 2026
File Upload Vulnerability in Flowise Package Leading to Remote Code Execution 8.3 high No fix published 08 Oct 2025
Unauthorized Access to TTS Endpoint in Flowise: API Credit Abuse Risk 8.2 high 3.1.0 17 Apr 2026
CVE-2026-30821: Flowise Arbitrary File Upload via MIME Spoofing Vulnerability 8.2 high 3.0.13 06 Mar 2026
Stored XSS Vulnerability in Flowise: Credential Theft Risk in Admin Panel 8.2 high 3.0.5 06 Oct 2025
High Severity Stored XSS Vulnerability in Flowise Package 8.2 high 3.0.5 06 Oct 2025
Unauthorized Organization Association in Flowise Package Due to Improper Mass Assignment 8.1 high 3.1.0 16 Apr 2026
Session Persistence Vulnerability in Flowise: Inadequate Session Invalidation After Password Change 8.1 high 3.0.10 14 Nov 2025
Cross-Workspace Evaluator Takeover in FlowiseAI: Mass Assignment Vulnerability 7.7 high 3.1.2 14 May 2026
Cross-Workspace Evaluation Takeover in FlowiseAI: Mass Assignment Vulnerability 7.7 high 3.1.2 14 May 2026
Cross-Workspace Data Takeover in FlowiseAI: Mass Assignment Vulnerability 7.7 high 3.1.2 14 May 2026
Cross-Workspace Dataset Takeover Vulnerability in FlowiseAI 7.7 high 3.1.2 14 May 2026
Cross-Workspace Template Takeover in FlowiseAI: Mass Assignment Vulnerability 7.7 high 3.1.2 14 May 2026
Cross-Workspace Assistant Takeover in FlowiseAI: Mass Assignment Vulnerability 7.7 high 3.1.2 14 May 2026
Authentication Bypass Vulnerability in Flowise Package 7.7 high 3.1.0 16 Apr 2026
Unauthenticated OAuth 2.0 Access Token Disclosure in Flowise 7.7 high 3.1.0 16 Apr 2026
Critical RCE Vulnerability in Flowise: Parameter Override Bypass 7.7 high 3.1.0 16 Apr 2026
Sensitive Data Exposure in Flowise: Public Chatbot Configuration Vulnerability 7.7 high 3.1.0 16 Apr 2026
CVE-2026-30824: Flowise Unauthenticated Access to NVIDIA NIM Endpoints 7.7 high 3.0.13 06 Mar 2026
CVE-2026-30822: Flowise Mass Assignment Vulnerability in Leads Endpoint 7.7 high 3.0.13 06 Mar 2026
Arbitrary File Exposure Vulnerability in Flowise - High Severity Risk 7.7 high 3.0.8 10 Oct 2025
CVE-2026-70474: Flowise Cross-Workspace OAuth2 Credential Metadata Leak 7.6 high 3.1.3 04 Aug 2026
CVE-2026-69257: Flowise SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses 7.6 high 3.1.3 04 Aug 2026
Mass Assignment Vulnerability in FlowiseAI Allows Unauthorized Resource Reassignment 7.6 high 3.1.2 14 May 2026
CVE-2026-42863: FlowiseAI Mass Assignment Vulnerability in Chatflow Update Endpoint 7.6 high 3.1.2 14 May 2026
CVE-2026-42862: FlowiseAI Mass Assignment Vulnerability in Tool Update Endpoint 7.6 high 3.1.2 14 May 2026
CVE-2026-42861: FlowiseAI Mass Assignment Vulnerability in Variable Update Endpoint 7.6 high 3.1.2 14 May 2026
Cross-Workspace Object Takeover Vulnerability in Flowise DocumentStore 7.6 high 3.1.0 17 Apr 2026
Exposed Basic Auth Credentials in Flowise Package - Medium Severity Vulnerability 7.5 high 3.1.2 14 May 2026
Insecure Password Reset Link in Flowise: Risk of MITM Attack 7.5 high 3.1.0 16 Apr 2026
Flowise Unauthenticated Denial of Service (DoS) Vulnerability 7.5 high No fix published 27 Aug 2024
Flowise CORS Misconfiguration in packages/server/src/index.ts 7.5 high No fix published 05 Aug 2024
CVE-2024-36420: Flowise Path Injection in npm/flowise 7.5 high No fix published 05 Aug 2024
Flowise Authentication Bypass Vulnerability 7.3 high No fix published 27 Aug 2024
CVE-2026-69252: Flowise API Authorization Flaw Allows Unauthorized File Access and Deletion 7.2 high 3.1.3 04 Aug 2026
CVE-2026-70475: Flowise Missing Authorization on Execution Update Endpoint 7.1 high 3.1.3 04 Aug 2026
CVE-2026-70472: Flowise Cross-Workspace Credential IDOR Vulnerability 7.1 high 3.1.3 04 Aug 2026
CVE-2026-70471: Flowise RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure 7.1 high 3.1.3 04 Aug 2026
CVE-2026-69262: Flowise Allows Unauthorized Deletion of Flow Types 7.1 high 3.1.3 04 Aug 2026
SSRF Vulnerability in Flowise Package: Security Bypass Risk 7.1 medium 3.1.0 23 Jun 2026
Critical SSRF Vulnerability in Flowise Package: APIChain Prompt Injection 7.1 high 3.1.0 16 Apr 2026
SSRF Protection Bypass in Flowise: Critical Vulnerability Detected 7.1 high 3.1.0 16 Apr 2026
SSRF Protection Bypass in Flowise: Access to Internal Resources 7.1 high 3.1.0 16 Apr 2026
File Upload Validation Bypass in FlowiseAI: A Path to Remote Code Execution 7.1 high 3.1.0 16 Apr 2026
CVE-2026-31829: Flowise HTTP Node Vulnerability Allows Server-Side Request Forgery (SSRF) 7.1 high 3.0.13 11 Mar 2026
Credential Data Leak in FlowiseAI: High Severity Vulnerability 7.0 high 3.1.2 14 May 2026
Cross-Origin Credential Abuse in Flowise TTS Endpoint 6.9 medium 3.1.2 20 May 2026
Sensitive User Information Exposure in Flowise Package - Unauthenticated Forgot Password Endpoint 6.9 medium 3.0.13 05 Mar 2026
Sensitive Data Exposure in Flowise: Incomplete Credential Redaction 6.5 medium 3.1.3 04 Aug 2026
Unauthorized Access to Private Chatflow TTS Credentials in Flowise 6.3 medium 3.1.4 04 Aug 2026
Critical XSS Vulnerability in Flowise Package 6.3 medium No fix published 03 Oct 2025
CVE-2024-36422: Flowise Cross-site Scripting in api/v1/chatflows/id 6.1 medium No fix published 05 Aug 2024
CVE-2024-37145: Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id 6.1 medium No fix published 05 Aug 2024
CVE-2024-36423: Flowise Cross-site Scripting in /api/v1/public-chatflows/id 6.1 medium No fix published 05 Aug 2024
CVE-2024-37146: Flowise Cross-site Scripting in /api/v1/credentials/id 6.1 medium No fix published 05 Aug 2024
Insecure Direct Object Reference in Flowise Package Exposes Sensitive Customer Data 6.0 medium 3.1.3 04 Aug 2026
Mass Assignment Vulnerability in Flowise: Bypass Password Change Verification 6.0 medium 3.1.2 20 May 2026
SSRF Vulnerability in Flowise and Flowise-Components: Risk of Internal Network Exposure 6.0 medium 3.1.0 16 Apr 2026
SQL Injection Vulnerability in FlowiseDB: Authenticated User Exploitation 5.9 medium No fix published 07 Apr 2025
Weak Default Token Hash Secret in Flowise Package 5.6 medium 3.1.0 16 Apr 2026
Weak Default Express Session Secret in Flowise: Session Hijacking Risk 5.6 medium 3.1.0 16 Apr 2026
Critical JWT Secret Vulnerability in Flowise: Weak Defaults Allow User Impersonation 5.6 medium 3.1.0 16 Apr 2026
Cross-Workspace Chatflow Disclosure in Flowise: Unprotected Chatflows Exposed 5.3 medium 3.1.2 20 May 2026
Critical SSRF Protection Bypass in Flowise: Exploiting Direct HTTP Client Usage 5.3 medium 3.1.0 16 Apr 2026
Critical Unauthenticated Information Disclosure in Flowise Package 5.3 medium 3.1.0 16 Apr 2026
Stored XSS Vulnerability in Flowise: Potential Credential Theft via Chat Logs 5.3 medium No fix published 03 Oct 2025
Path Traversal Vulnerability in Flowise Package: Arbitrary File Write Risk 4.9 medium 3.1.0 16 Apr 2026
Insufficient Password Salt Rounds Vulnerability in Flowise 4.1 medium 3.0.13 05 Mar 2026
CVE-2026-8026: Flowise Bcrypt Password Hash Exposure Vulnerability 3.7 medium No fix published 06 May 2026
Cypher Injection Vulnerability in Flowise Packages N/A high 3.1.0 16 Apr 2026

Looking for another version, or everything Vulert holds for flowise?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About flowise 2.0.7

Is flowise 2.0.7 vulnerable?

Yes. 109 vulnerabilities in the Vulert database cover flowise 2.0.7: 26 critical, 59 high, 24 medium and 0 low. The upgrade Vulert recommends is 3.1.4, and each entry above names the fixed version to move to.

Which version of flowise should I use instead of 2.0.7?

3.1.4 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 2.0.7 the latest release of flowise?

No. 2.0.7 was published 28 Aug 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor flowise for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the flowise version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.