Flowise Remote Code Injection Vulnerability

# Flowise Remote Code Injection Vulnerability

https://gcdradar.vercel.app/incidents/flowise-remote-code-injection-vulnerability · AIR-2024-0101 · closed 2024-04-29

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-04-29
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2024-31621
- CVSS: 7.6

## Summary

An issue in Flowise allows remote attackers to execute arbitrary code via a crafted script sent to the API endpoint. The vulnerability was addressed in version 1.8.1.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-04-29: CVE-2024-31621: An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to… (https://nvd.nist.gov/vuln/detail/CVE-2024-31621)
- 2024-04-29: CVE-2024-31621: Flowise vulnerable to code injection via api/v1 (https://github.com/advisories/GHSA-6wp6-22x5-rr3w)

## Sources

- 2024-04-29 GitHub Advisory Database: CVE-2024-31621: Flowise vulnerable to code injection via api/v1 https://github.com/advisories/GHSA-6wp6-22x5-rr3w
- 2024-04-29 NVD: CVE-2024-31621: An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to… https://nvd.nist.gov/vuln/detail/CVE-2024-31621

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.