CVE Intelligence

Npm Flowise vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Npm Flowise: 1 record(s), with affected versions and fixes.

CVE-2025-71332 High · 8.8 CWE-89 Jun 24, 2026
Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.