Flowise: Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Medium, CVSS 6.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Record
- CVE-2025-71331
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 20, 2026
- Source last modified
- October 19, 2026
Description
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascript:alert(document.cookie)">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.
Description quoted from the NVD record.