PT-2025-42635 · Flowiseai · Flowise

Published 2025-09-15 · Updated 2025-10-17 · CVE-2025-57164

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flowise versions through 3.0.4

Description FlowiseAI is susceptible to remote code execution due to the lack of input sanitization within the "Supabase RPC Filter" component. An authenticated administrator can inject malicious payloads into the supabaseRPCFilter field, leading to the execution of arbitrary server-side code. This is achieved through the use of JavaScript’s execSync() function, enabling actions such as launching reverse shells, accessing environment secrets, and executing operating system-level commands. The vulnerable component is located at packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237. Exploitation involves crafting a filter expression to trigger code execution, potentially leading to full server compromise and exposure of sensitive information like the JWT REFRESH TOKEN SECRET. The vulnerability violates the trust boundary between frontend input and backend execution logic, specifically relating to OWASP LLM Top 10 - LLM-06: Sensitive Code Execution.

Recommendations Versions prior to 3.0.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2025-57164

GHSA-3G4J-R53P-22WX

GHSA-7944-7C6R-55VV

Affected Products

Flowise

References · 13

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57164 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57164 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3g4j-r53p-22wx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7944-7c6r-55vv · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6 · Note
• https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237 · Note
• https://github.com/FlowiseAI/Flowise/blob/flowise%403.0.5/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237 · Note
• https://twitter.com/VulmonFeeds/status/1979274203195973989 · Twitter Post
• https://twitter.com/CVEnew/status/1979289045348818982 · Twitter Post
• https://t.me/cveNotify/139227 · Telegram Post
• https://t.me/cveNotify/139257 · Telegram Post