{"action":"Upgrade flowise-embed to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"flowise-embed","cve_ids":["CVE-2024-9148"],"ecosystem":"npm","epss":0.00559,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-m5p9-xvxj-64c8","id":"tcs_01M5KFZN93JQ4VA1RAGEA7RD3R","modified_at":"2024-09-30T21:27:16.250091Z","published_at":"2024-09-25T03:30:36Z","references":["https://osv.dev/vulnerability/GHSA-m5p9-xvxj-64c8","https://nvd.nist.gov/vuln/detail/CVE-2024-9148","https://github.com/FlowiseAI/Flowise/commit/8375ebb4ec1ebb2b1295561cc0f63486a29f3fde","https://github.com/FlowiseAI/FlowiseChatEmbed/commit/6a9645df41371cb69f251038d501ec87b1304c84","https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.1.1","https://github.com/FlowiseAI/FlowiseChatEmbed","https://github.com/FlowiseAI/FlowiseChatEmbed/releases/tag/flowise-embed%402.0.0","https://www.tenable.com/security/research/tra-2024-40"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-m5p9-xvxj-64c8","url":"https://osv.dev/vulnerability/GHSA-m5p9-xvxj-64c8"}],"summary":"Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting"}