{"action":"Upgrade flowise to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"3.0.1"}],"component":"flowise","cve_ids":["CVE-2025-34267"],"ecosystem":"npm","epss":0.06561,"exploited":false,"fixed_versions":["3.0.8"],"ghsa_id":"GHSA-r4hh-pcgx-j5r2","id":"tcs_01M5KG7WR1XG4M9RZ8K7C4H24R","modified_at":"2025-10-29T05:14:59.637938Z","published_at":"2025-10-14T21:30:47Z","references":["https://osv.dev/vulnerability/GHSA-r4hh-pcgx-j5r2","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5w3r-f6gm-c25w","https://nvd.nist.gov/vuln/detail/CVE-2025-34267","https://github.com/FlowiseAI/Flowise/pull/5231","https://flowiseai.com","https://github.com/FlowiseAI/Flowise","https://www.vulncheck.com/advisories/flowise-auth-command-execution-and-sandbox-bypass-via-puppeteer-and-playwright-packages"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-r4hh-pcgx-j5r2","url":"https://osv.dev/vulnerability/GHSA-r4hh-pcgx-j5r2"},{"source":"nvd","source_id":"CVE-2025-34267","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34267"}],"summary":"Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages"}