CVE-2025-55346
Critical · 9.8CVSS
9.8
EPSS
22.4%
Published
Aug 14, 2025
CISA due date
—
The record
User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | flowise | 0 | No fix |
Related vulnerabilities
- CVE-2026-46478 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46477 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46479 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46480 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46442 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46444 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46440 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46475 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise