GHSA-6r77-hqx7-7vw8: Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Summary

FlowiseAI's POST and GET API Chain components build request URLs from LLM output without validating them against the intended API documentation. Unauthenticated attackers can inject a crafted documentation prompt that overrides the BASE URL, causing the server to send arbitrary HTTP requests to internal and external hosts, as demonstrated against /flag on host.docker.internal:8080. The source affects FlowiseAI instances at version 2.2.1 and below.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Topics

• Prompt injection and jailbreaks

Related items

• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs
• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoMMA-SafetyBench: A Benchmark for Multimodal Agent Safety EvaluationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPolicy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy RewardsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)