CVE-2025-29192High· 8.2▾ TwilightFlowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
flowise < 3.0.5Upgrade past the affected range:
flowise 3.0.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-50538High· 8.2Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
GHSA-6j9g-8fxc-25hqCritical· 8.8Duplicate Advisory: Flowise contains an unauthenticated sandbox escape
GHSA-x3jw-7gj7-qv6mCritical· 9.8Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
CVE-2026-73483CriticalFlowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
CVE-2026-73487CriticalFlowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
CVE-2025-71335High· 8.1Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password