{"data":{"id":"eabd879f-4e4f-44bf-9fba-ac98f2585dc5","title":"CVE-2025-59434: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025…","summary":"CVE-2025-59434 affects Flowise Cloud, the cloud-hosted version of Flowise, prior to August 2025. An authenticated user on the free tier can use the Custom JavaScript Function node to read sensitive environment variables belonging to other tenants, including OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets, resulting in full cross-tenant data exposure.","solution":"This issue has been patched in the August 2025 Cloud-Hosted Flowise.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59434","publishedAt":"2025-09-23T00:15:39.017Z","cveId":"CVE-2025-59434","cweIds":["CWE-200","CWE-284"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Flowise","OpenAI","AWS","Supabase","Google Cloud"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.04029,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:47.065Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}