GHSA-xhmj-rg95-44hv: Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Summary

The Flowise Custom Function feature applies SSRF protection only to the axios and node-fetch libraries through the HTTP_DENY_LIST setting. The built-in http, https and net modules are passed to the NodeVM sandbox without that protection, so an authenticated user can import them directly and reach internal resources such as cloud metadata services. The advisory includes a proof of concept that retrieves IAM role credentials from the AWS EC2 metadata endpoint at 169.254.169.254.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Related items

• MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
• MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
• MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
• HighCVE-2026-104103: Ludwig archive extraction allows writes outside extraction directorySimilar attack · NVD/CVE Database