CVE-2025-71331

Katalog CVE

CVSS 6.1 · Medium EPSS 0,33%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada flowiseai flowise. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascript:alert(document.cookie)">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.

Rincian

Terbit di NVD

20 Juni 2026

Terakhir diubah

23 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wv exploit · advisory vendor
• https://www.vulncheck.com/advisories/flowise-cross-site-scripting-in-chat-messages-and-agent-workflows advisory pihak ketiga