{"data":{"id":"ec844979-3efa-4f1b-beea-e7d5452d53ef","title":"CVE-2024-36421: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A…","summary":"CVE-2024-36421 affects Flowise, a drag and drop interface for building customized large language model flows, in version 1.4.3. A CORS misconfiguration sets Access-Control-Allow-Origin to all, so arbitrary origins can connect to the website. In the default unauthenticated configuration, those origins may make requests to Flowise and steal information from the user. The flaw may be chained with a path injection to let an attacker without Flowise access read arbitrary files from the Flowise server.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-36421","publishedAt":"2024-07-01T16:15:04.623Z","cveId":"CVE-2024-36421","cweIds":["CWE-346","CWE-346"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["flowise@<= 1.4.3"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Flowise CORS misconfiguration allowing arbitrary origin access","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.08495,"epssCheckedAt":"2026-11-04T00:12:27.047Z","kevDateAdded":null,"advisoryAliases":["GHSA-66f2-xxgm-f6xp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:38.235Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}