{"data":{"id":"3e34ee2f-18e8-470a-aa19-70f5025fdf09","title":"CVE-2026-41269: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow…","summary":"Flowise, a drag-and-drop interface for building customized large language model flows, is affected before version 3.1.0. The Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type, letting an attacker upload .js files that the frontend does not normally permit. This allows persistent storage of malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE).","solution":"Fixed in 3.1.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41269","publishedAt":"2026-04-23T20:16:15.417Z","cveId":"CVE-2026-41269","cweIds":["CWE-434"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise arbitrary JavaScript upload through Chatflow file upload settings","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00472,"epssCheckedAt":"2026-11-10T06:09:43.331Z","kevDateAdded":null,"advisoryAliases":["GHSA-rh7v-6w34-w2rr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:15.808Z","patchAvailable":true,"disclosureDate":"2026-04-23T20:16:15.417Z","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"fixCheckedAt":"2026-10-29T21:37:33.780Z","capecIds":["CAPEC-1"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.0","matchedVersion":"3.1.0","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:33.634Z"}]}}