{"data":{"id":"9e77eaca-1304-493f-ba38-cedd8b70aec7","title":"CVE-2026-41271: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side…","summary":"CVE-2026-41271 affects Flowise versions prior to 3.1.0, specifically the POST/GET API Chain components. Unauthenticated attackers can inject malicious prompt templates to force the server to make arbitrary HTTP requests to internal and external systems, bypassing the intended API documentation constraints. This can enable internal network reconnaissance and data exfiltration.","solution":"Fixed in 3.1.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41271","publishedAt":"2026-04-23T20:16:15.683Z","cveId":"CVE-2026-41271","cweIds":["CWE-918"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection","supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.13 (fixed: 3.1.0)","flowise-components@<= 3.0.13 (fixed: 3.1.0)"],"affectedPackageNames":["flowise","flowise-components"],"affectedPackageRefs":["npm:flowise","npm:flowise-components"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise server-side request forgery in POST/GET API Chain components","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00233,"epssCheckedAt":"2026-11-09T18:09:53.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-6r77-hqx7-7vw8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:14.735Z","patchAvailable":true,"disclosureDate":"2026-04-23T20:16:15.683Z","fixReleasedAt":"2026-03-16T14:45:59.849Z","daysToFix":-38,"fixCheckedAt":"2026-10-29T21:37:32.302Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"],"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.0","matchedVersion":"3.1.0","fixReleasedAt":"2026-03-16T14:47:16.783Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:32.155Z"},{"ecosystem":"npm","name":"flowise-components","fixedVersion":"3.1.0","matchedVersion":"3.1.0","fixReleasedAt":"2026-03-16T14:45:59.849Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:32.155Z"}]}}