{"data":{"id":"87941bf1-fa10-4cb3-a79b-8e5ad81ee7b0","title":"CVE-2025-61913: Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8…","summary":"CVE-2025-61913 affects Flowise, a drag and drop user interface for building customized large language model flows, in versions prior to 3.0.8. The WriteFileTool and ReadFileTool do not restrict file path access, so an authenticated attacker can read and write arbitrary files at any path on the file system, potentially leading to remote command execution.","solution":"Flowise 3.0.8 fixes this vulnerability.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61913","publishedAt":"2025-10-08T23:15:31.357Z","cveId":"CVE-2025-61913","cweIds":["CWE-22"],"cvssScore":"9.9","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@< 3.0.8 (fixed: 3.0.8)","flowise-components@< 3.0.8 (fixed: 3.0.8)","Flowise@<= 3.0.5 (fixed: 3.0.8)"],"affectedPackageNames":["flowise","flowise-components"],"affectedPackageRefs":["npm:flowise","npm:flowise-components"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise path traversal in WriteFileTool and ReadFileTool allows","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.13873,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":["GHSA-jv9m-vf54-chjj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:19.971Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-10-08T12:07:48.293Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:43:26.509Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise-components","fixedVersion":"3.0.8","matchedVersion":"3.0.8","fixReleasedAt":"2025-10-08T12:07:48.293Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:26.358Z"},{"ecosystem":"npm","name":"flowise","fixedVersion":"3.0.8","matchedVersion":"3.0.8","fixReleasedAt":"2025-10-08T12:15:38.140Z","daysToFix":0,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:26.358Z"}]}}