{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.2.7"}],"component":"flowise","cve_ids":["CVE-2025-71338"],"ecosystem":"npm","epss":0.01157,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8vvx-qvq9-5948","id":"tcs_01M5KFE35YYZ0VX1C9PT9FABV0","modified_at":"2026-07-08T07:35:35.228795273Z","published_at":"2025-03-14T18:48:44Z","references":["https://osv.dev/vulnerability/GHSA-8vvx-qvq9-5948","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948","https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7","https://github.com/FlowiseAI/Flowise"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-8vvx-qvq9-5948","url":"https://osv.dev/vulnerability/GHSA-8vvx-qvq9-5948"}],"summary":"Flowise allows arbitrary file write to RCE"}