CVE-2024-9148: Flowise and Flowise Chat Embed stored XSS vulnerability

# CVE-2024-9148: Flowise and Flowise Chat Embed stored XSS vulnerability

https://gcdradar.vercel.app/incidents/cve-2024-9148-flowise-and-flowise-chat-embed-stored-xss-vuln · AIR-2024-0173 · closed 2024-09-25

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-09-25
- AI role: Attack on AI
- Products: Flowise, Flowise Chat Embed
- CVE ids: CVE-2024-9148
- CVSS: 9.6

## Summary

Flowise and Flowise Chat Embed suffered from stored cross-site scripting due to a lack of input sanitization. The vulnerability was addressed in subsequent versions.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-09-25: CVE-2024-9148: Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0. (https://nvd.nist.gov/vuln/detail/CVE-2024-9148)
- 2024-09-25: CVE-2024-9148: Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting (https://github.com/advisories/GHSA-m5p9-xvxj-64c8)

## Sources

- 2024-09-25 GitHub Advisory Database: CVE-2024-9148: Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting https://github.com/advisories/GHSA-m5p9-xvxj-64c8
- 2024-09-25 NVD: CVE-2024-9148: Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0. https://nvd.nist.gov/vuln/detail/CVE-2024-9148

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.