CVE-2024-58351: Flowise OverrideConfig security vulnerability

# CVE-2024-58351: Flowise OverrideConfig security vulnerability

https://gcdradar.vercel.app/incidents/cve-2024-58351-flowise-overrideconfig-security-vulnerability · AIR-2024-0201 · closed 2024-11-21

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-11-21
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2024-58351
- CVSS: 8.6

## Summary

Flowise features an insecure overrideConfig option that enables remote code execution, sandbox escape, and prompt injection. The vulnerability impacts both frontend integrations and the backend Prediction API.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-20: CVE-2024-58351: Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option,… (https://nvd.nist.gov/vuln/detail/CVE-2024-58351)
- 2024-11-21: CVE-2024-58351: Flowise OverrideConfig security vulnerability (https://github.com/advisories/GHSA-5cph-wvm9-45gj)

## Sources

- 2024-11-21 GitHub Advisory Database: CVE-2024-58351: Flowise OverrideConfig security vulnerability https://github.com/advisories/GHSA-5cph-wvm9-45gj
- 2026-06-20 NVD: CVE-2024-58351: Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option,… https://nvd.nist.gov/vuln/detail/CVE-2024-58351

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.