PT-2026-51145 · Flowise · Flowise

Quitbug · Published 2026-06-20 · Updated 2026-06-20 · CVE-2025-71331

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., ) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-71331

Affected Products

Flowise

References · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71331 · Security Note
• https://vulncheck.com/advisories/flowise-cross-site-scripting-in-chat-messages-and-agent-workflows · Note