Advisory details:
gitlab / npm/flowise-components/GHSA-6r77-hqx7-7vw8
| Advisory ID | gitlab/npm/flowise-components/GHSA-6r77-hqx7-7vw8 |
| Aliases |
GHSA-6r77-hqx7-7vw8
|
| Summary | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains A Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/flowise-components/GHSA-6r77-hqx7-7vw8.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/FlowiseAI/Flowise | ||
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6r77-hqx7-7vw8 | ||
| GHSA-6r77-hqx7-7vw8 | https://github.com/advisories/GHSA-6r77-hqx7-7vw8 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.