CVE-2024-58351: Flowise - Remote Code Execution via overrideConfig Parameter
Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allow-list of permitted variables and relies on vm2 for sandboxing, an attacker can abuse it to achieve remote code execution and sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server variable and data exfiltration. These issues are self-targeted and do not persist to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 2.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58351?
The severity of CVE-2024-58351 is critical with a CVSS score of 9.8.
How do I fix CVE-2024-58351?
To fix CVE-2024-58351, upgrade Flowise to version 2.1.4 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2024-58351?
CVE-2024-58351 is classified as a Remote Code Execution vulnerability due to code injection through the overrideConfig parameter.
Who is affected by CVE-2024-58351?
Users of Flowise versions prior to 2.1.4 are affected by CVE-2024-58351.
What should I do if I cannot upgrade to fix CVE-2024-58351?
If you cannot upgrade, consider disabling the overrideConfig option in your Flowise configuration until a fix can be applied.