GHSA-3g4j-r53p-22wx
Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution
Withdrawn ·
At a glance
- Published
- Updated
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7944-7c6r-55vv. This link is maintained to preserve external references. ### Original Description Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.
Affected packages
| Package | Versions |
|---|---|
| npm · flowise | introduced 3.0.5, fixed 3.0.6 |
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-57164 ADVISORY
- https://github.com/FlowiseAI/Flowise WEB
- https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |