8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7rgr-72hp-9wp3

GHSA-7rgr-72hp-9wp3: Duplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-964p-j4gg-mhwc. This link is maintained to preserve external references.

Original Description

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7rgr-72hp-9wp3

GHSA-7rgr-72hp-9wp3:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flowise	npm	< 3.0.5	3.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Flowise admin panel. The root cause is the use of React's dangerouslySetInnerHTML property to render HTML content from user-provided data without proper sanitization. This was identified in multiple UI components:

ViewMessagesDialog: This is the primary component mentioned in the advisory's title ("View Messages"). It rendered chat messages of type 'html' directly into the DOM.
ChatMessage: A similar component for displaying individual chat messages, also using dangerouslySetInnerHTML.
NodeExecutionDetails: This component, used for displaying details of an agent's execution, also rendered artifact data directly as HTML.
JSONViewer: This component used dangerouslySetInnerHTML to render syntax-highlighted JSON, which could be manipulated to include malicious HTML.

The patch addresses this by introducing a new SafeHTML component. This component uses the DOMPurify library to sanitize the HTML content, removing any potentially malicious elements like <script> tags and on* event handlers, before rendering it. By replacing all instances of dangerouslySetInnerHTML with this new safe component, the XSS vulnerability is mitigated across the application.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.