npm/flowise CVE-2024-9148: critical 9.6, EPSS 0.56%

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

Action: Upgrade flowise to 2.1.1 or later.

npm i flowise@2.1.1

Affected

Fixed versions

Sources

• osv: GHSA-m5p9-xvxj-64c8#npm/flowise
• https://nvd.nist.gov/vuln/detail/CVE-2024-9148
• https://github.com/FlowiseAI/Flowise/commit/8375ebb4ec1ebb2b1295561cc0f63486a29f3fde
• https://github.com/FlowiseAI/FlowiseChatEmbed/commit/6a9645df41371cb69f251038d501ec87b1304c84
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.1.1
• https://github.com/FlowiseAI/FlowiseChatEmbed
• https://github.com/FlowiseAI/FlowiseChatEmbed/releases/tag/flowise-embed%402.0.0
• https://www.tenable.com/security/research/tra-2024-40

CVE-2024-9148 · published 2024-09-25T03:30:36Z · modified 2024-09-30T21:27:16.250091Z · JSON