CVE-2024-36420: GHSL-2023-232_GHSL-2023-234: Path injection, Cross-Site Scripting (XSS) and CORS misconfiguration in Flowise - CVE-2024-36420, CVE-2024-36421, CVE-2024-36422, CVE-2024-36423, CVE-2024-37145, CVE-2024-37146
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.
Other sources
Flowise is vulnerable to path injection, cross site scripting and CORS misconfiguration vulnerabilities, that may compromise the confidentiality of the information on the host server. In the worst case, it may allow attackers to read files from the Flowise server and read/modify user secrets.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36420?
CVE-2024-36420 is considered a high-severity vulnerability due to its potential for arbitrary file reading.
How do I fix CVE-2024-36420?
To fix CVE-2024-36420, update Flowise to version 1.4.4 or later, which addresses the lack of sanitization in the affected endpoint.
What versions of Flowise are affected by CVE-2024-36420?
Versions of Flowise up to and including 1.4.3 are affected by CVE-2024-36420.
What is the impact of CVE-2024-36420?
The impact of CVE-2024-36420 allows attackers to read arbitrary files on the server, potentially exposing sensitive data.
Is there a workaround for CVE-2024-36420?
As a temporary workaround for CVE-2024-36420, you can restrict access to the impacted endpoint until the software is updated.