npm/flowise-embed CVE-2024-9148: critical 9.6, EPSS 0.56%

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

Action: Upgrade flowise-embed to 2.0.0 or later.

npm i flowise-embed@2.0.0

Affected

Fixed versions

Sources

• osv: GHSA-m5p9-xvxj-64c8
• https://nvd.nist.gov/vuln/detail/CVE-2024-9148
• https://github.com/FlowiseAI/Flowise/commit/8375ebb4ec1ebb2b1295561cc0f63486a29f3fde
• https://github.com/FlowiseAI/FlowiseChatEmbed/commit/6a9645df41371cb69f251038d501ec87b1304c84
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.1.1
• https://github.com/FlowiseAI/FlowiseChatEmbed
• https://github.com/FlowiseAI/FlowiseChatEmbed/releases/tag/flowise-embed%402.0.0
• https://www.tenable.com/security/research/tra-2024-40

CVE-2024-9148 · published 2024-09-25T03:30:36Z · modified 2024-09-30T21:27:16.250091Z · JSON