Executive Summary

CVE-2025-71331 is a cross-site scripting (XSS) vulnerability in Flowise versions prior to 3.0.8 caused by insufficient input filtering in chat messages and custom agent functions.

An attacker can inject malicious JavaScript code by sending a payload such as an iframe with a javascript URI in a chat box or by having a custom agent function return an XSS payload from an external website.

When the victim interacts with the affected web pages, the injected script executes in their browser, potentially allowing the attacker to steal cookies and session data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the victim's browser, which can result in theft of cookies and session data.

Such theft can allow attackers to hijack user sessions, impersonate users, and gain unauthorized access to sensitive information or functionalities within the Flowise platform.

All users of the Flowise platform who utilize agent workflows or chat features are at risk if they use affected versions prior to 3.0.8.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for malicious JavaScript payloads, such as iframe tags with javascript: URIs, being sent through chat messages or custom agent functions in Flowise versions prior to 3.0.8.

Specifically, detection involves inspecting chat inputs and agent workflows for suspicious payloads like <iframe src="javascript:alert(document.cookie)"> or other script injections.

While no specific detection commands are provided, network or application logs can be searched for patterns matching iframe tags or javascript: URIs in chat messages or agent function outputs.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Flowise to version 3.0.8 or later, where the cross-site scripting vulnerability has been fixed by improving input filtering.

Until the upgrade can be applied, avoid using custom agent functions that fetch content from external websites and be cautious with chat inputs to prevent injection of malicious scripts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to inject malicious scripts that can steal cookies and session data from users. This unauthorized access to session data could potentially lead to exposure of personal or sensitive information.

Such data breaches may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and disclosure.

However, the provided information does not explicitly discuss the direct effects of this vulnerability on compliance with these standards.

Useful 0 Not Useful 0