PT-2025-15692 · Flowise · Flowise

CVE-2025-29189 · Published 2025-04-09 · Updated 2025-04-14

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Flowise versions 2.2.3 and earlier

Description: The issue is related to SQL Injection, which occurs via the tableName parameter at Postgres VectorStores. This allows for potential exploitation.

Recommendations: For versions 2.2.3 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the tableName parameter in the Postgres VectorStores to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-29189

GHSA-GJX9-WG9X-7GVP

Affected Products

Flowise

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29189.json · Exploit
• 🔥 https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2025-29189 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjx9-wg9x-7gvp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29189 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/pull/3818 · Note
• https://github.com/FlowiseAI/Flowise/commit/9a417bdc95f58d6dd92cbf60dad42414aba34754 · Note
• https://twitter.com/cracbot/status/1911736261498343640 · Twitter Post
• https://t.me/cvetracker/21217 · Telegram Post
• https://t.me/cvedetector/22558 · Telegram Post