Skip to content
Threat Feed

Tag

Flowise

2 briefs RSS
critical advisory

Flowise Authenticated Remote Code Execution via MCP Adapter

Flowise versions 3.0.13 and earlier are vulnerable to authenticated arbitrary command execution due to unsafe serialization of stdio commands in the MCP adapter, allowing a malicious user to execute commands on the underlying operating system.

flowise rce command-injection
3r 1t
high advisory

Flowise SSRF Protection Bypass via Unprotected Built-in HTTP Modules

Flowise is vulnerable to SSRF protection bypass via unprotected built-in HTTP modules in the custom function sandbox, allowing authenticated users to access internal network resources by exploiting the lack of SSRF protection on Node.js `http`, `https`, and `net` modules.

ssrf flowise cloud
2r 1t