Vulnerability details

CVE-2024-58351

Flowise Flowise

Flowise - Remote Code Execution via overrideConfig Parameter

CVSS 4.0

9.3Critical

Official description

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allow-list of permitted variables and relies on vm2 for sandboxing, an attacker can abuse it to achieve remote code execution and sandbox escape, denial of service by crashing the server, server-side request forgery, prompt injection, and server variable and data exfiltration. These issues are self-targeted and do not persist to other users.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Flowise	Flowise	v < 2.1.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5cph-wvm9-45gj vendor-advisory
https://www.vulncheck.com/advisories/flowise-remote-code-execution-via-overrideconfig-parameter third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-20
Last updated: 2026-11-08
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 27 · Low

Exploit prediction (EPSS)

0.66%

Probability of exploitation in 30 days

51.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')