GHSA-xhmj-rg95-44hv: Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Flowise has a security flaw in its Custom Function feature where SSRF (Server-Side Request Forgery, a type of attack where a server is tricked into making unwanted network requests) protection only covers two libraries (axios and node-fetch) but leaves built-in Node.js modules like http, https, and net unprotected. This allows authenticated users to bypass the security controls and access internal network resources, such as cloud provider metadata services that contain sensitive credentials.