{"data":{"id":"1c85c082-06d4-4aa2-a39c-f1f0e10425a6","title":"GHSA-2x8m-83vc-6wv4: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)","summary":"The secureAxiosRequest and secureFetch wrappers in Flowise's packages/components/src/httpSecurity.ts are meant to block SSRF but can be bypassed. When HTTP_DENY_LIST is unset, checkDenyList returns immediately and allows all requests, including localhost. A DNS rebinding attack exploits the gap between the dns.lookup used for validation and the second lookup the HTTP client makes, letting an attacker serve a safe IP first and an internal address such as 127.0.0.1 afterward. The source rates the confidentiality impact as High, since internal services become reachable.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2x8m-83vc-6wv4","publishedAt":"2026-04-16T21:51:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise-components@<= 3.0.13 (fixed: 3.1.0)","flowise@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise-components","flowise"],"affectedPackageRefs":["npm:flowise","npm:flowise-components"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-2x8m-83vc-6wv4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-16T21:51:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}