CVE-2026-91938
Received Received - Intake

Flowise Cheerio Playwright Puppeteer SSRF Bypass Before 3.1.4

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91938
EUVD
EUVD-2026-78796

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
flowiseai flowise to 3.1.4 (exc)
flowiseai flowise_components to 3.1.4 (exc)
langchain cheeriowebbaseloader *
langchain playwrightloader *
langchain puppeteerloader *
flowise flowise to 3.1.4 (exc)
cheerio cheerio *
playwright playwright *
puppeteer puppeteer *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flowise versions before 3.1.4 have a server-side request forgery (SSRF) vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes. This flaw bypasses SSRF protection, allowing attackers to provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources. The response content is returned as document text.

Detection Guidance

Detecting this SSRF vulnerability in Flowise versions before 3.1.4 requires checking for document loader nodes using Cheerio, Playwright, or Puppeteer. Inspect server logs for unusual outbound requests to cloud metadata services or internal IP addresses. Monitor network traffic for unexpected connections to private network resources.

Impact Analysis

An attacker could exploit this to access sensitive internal resources, exfiltrate data, or interact with private network services. This may lead to unauthorized information disclosure, data breaches, or further network compromise depending on the exposed services.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or mishandled due to the SSRF flaw.

Mitigation Strategies

Upgrade Flowise to version 3.1.4 or later to address the SSRF vulnerability. Disable or restrict access to document loader nodes if not required. Implement network-level controls to block outbound requests to private IP ranges and cloud metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart