Vulnerability Description
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascript:alert(document.cookie)">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flowiseai | Flowise | < 3.0.8 |
Related Weaknesses (CWE)
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wvExploitVendor Advisory
- https://www.vulncheck.com/advisories/flowise-cross-site-scripting-in-chat-messagThird Party Advisory
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wvExploitVendor Advisory
FAQ
What is CVE-2025-71331?
CVE-2025-71331 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript...
How severe is CVE-2025-71331?
CVE-2025-71331 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71331?
Check the references section above for vendor advisories and patch information. Affected products include: Flowiseai Flowise.