Cross-Site Scripting Vulnerability in Flowise Software by FlowiseAI

CVE-2025-71331

What is CVE-2025-71331?

Prior to version 3.0.8, Flowise software has a vulnerability that permits cross-site scripting due to inadequate input filtering in chat messages and custom agent functions. An attacker can exploit this flaw by sending an iframe payload within a chat box or through a custom agent function, allowing external scripts to be executed in the victim's browser. This leads to the potential theft of cookies and session information, compromising user security and privacy.

References