Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-yuwm-n652-ykd9

Summary

Flowise Stored XSS vulnerability through logs in chatbot
In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive information with stored Cross Site Scripting.

Aliases

alias	CVE-2025-29192

alias	GHSA-7r4h-vmj9-wg42

Fixed_packages

url pkg:npm/flowise@3.0.5

purl pkg:npm/flowise@3.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2wkq-5agr-6bgz

vulnerability	VCID-5vb2-73xr-97cw

vulnerability	VCID-8wyy-ep3u-xkh5

vulnerability	VCID-gjgw-sjnh-zkhr

vulnerability	VCID-rhdz-rcy5-y3a6

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/flowise@3.0.5

Affected_packages

References

reference_url	https://github.com/FlowiseAI/Flowise
reference_id
reference_type
scores
url	https://github.com/FlowiseAI/Flowise

reference_url	https://github.com/FlowiseAI/Flowise/commit/9a06a85a8ddcbaeca1342827a5fea9087a587d97
reference_id
reference_type
scores
url	https://github.com/FlowiseAI/Flowise/commit/9a06a85a8ddcbaeca1342827a5fea9087a587d97

reference_url	https://github.com/FlowiseAI/Flowise/pull/4905
reference_id
reference_type
scores
url	https://github.com/FlowiseAI/Flowise/pull/4905

reference_url	https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5
reference_id
reference_type
scores
url	https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2025-29192
reference_id	CVE-2025-29192
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2025-29192

reference_url	https://github.com/advisories/GHSA-7r4h-vmj9-wg42
reference_id	GHSA-7r4h-vmj9-wg42
reference_type
scores
url	https://github.com/advisories/GHSA-7r4h-vmj9-wg42

reference_url	https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42
reference_id	GHSA-7r4h-vmj9-wg42
reference_type
scores
url	https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42

Weaknesses

cwe_id	79
name	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yuwm-n652-ykd9

Vulnerability Instance