Vulnerabilities

FlowiseAI Flowise up to version 3.0.2 contains a server-side request forgery (SSRF) flaw in the Evaluations Endpoint, specifically in the axios.post call within packages/server/src/controllers/evaluations/index.ts. A remote attacker who manipulates the Host or X-Forwarded-Proto headers can trick the server into issuing requests toward attacker-influenced destinations, potentially reaching internal services, cloud metadata endpoints, or other network resources reachable from the Flowise host. The CVSS 4.0 vector indicates low privileges are required (PR:L), so an attacker needs at least limited authenticated access to the Flowise instance, and overall impact is rated low (2.1). Only Flowise versions that are no longer supported by the maintainer are affected, and a public exploit reference exists as a GitHub issue on the Flowise repository. EPSS is very low (0.2%, 12th percentile), the issue is not in the CISA KEV catalog, and no active exploitation in the wild has been reported.

Do: Upgrade Flowise to version 3.1.3 or later, which contains the patch (commit 700137738bcaebefd4709021f6d6b0abcd7df0ac); since affected versions are unsupported, running them long-term is not viable. If upgrading is delayed, restrict access to the evaluations endpoint to trusted authenticated users, avoid blindly trusting Host/X-Forwarded-Proto headers from untrusted proxies, and egress-filter the Flowise server so it cannot reach internal services or metadata endpoints. Review server logs for unexpected outbound requests originating from the evaluations controller as evidence of exploitation attempts.

Flowise versions before 3.1.4 contain a missing-authorization flaw (CWE-862) in the /api/v1/text-to-speech/abort endpoint, which accepts user-supplied chatflowId and chatId values without verifying that the requester owns the session. An unauthenticated remote attacker who knows or guesses valid identifiers can submit abort requests that terminate other users' active chatflow predictions, causing targeted service disruption. The impact is limited to availability of individual chat sessions (CVSS 4.0: 6.3, medium) with no confidentiality or integrity impact. Anyone running a self-hosted Flowise instance on a version prior to 3.1.4, especially one exposed to untrusted networks, is affected. Exploitation status: a public advisory/PoC reference exists, EPSS is very low (0.2%, 16th percentile), and the flaw is not in the CISA KEV catalog, so no in-the-wild exploitation is known.

Do: Upgrade Flowise to version 3.1.4 or later, where ownership verification for the abort endpoint is enforced. If immediate patching is not possible, place Flowise behind an authenticating reverse proxy or restrict network access so unauthenticated callers cannot reach /api/v1/text-to-speech/abort. Review application logs for abort requests referencing chatflowId/chatId values not associated with legitimate sessions as an indicator of abuse.

CVE-2026-86431 is a cross-site scripting vulnerability in the PHP Markdown rendering library league/commonmark (versions 2.7.0 through 2.9.0) in which the AttributesExtension's event-handler and unsafe-link filtering can be bypassed by prefixing an attribute name with a single U+000C form feed byte, which PHP's trim() does not strip, so the attribute is written verbatim into the rendered HTML where browsers treat it as a genuine event handler. It is triggered whenever a server processes untrusted Markdown with the AttributesExtension enabled; the same trick also defeats the allow_unsafe_links check, letting javascript: URIs pass through href/src attributes. An attacker who can submit Markdown therefore gains arbitrary script execution in the browser of any user viewing the rendered page, which can lead to session theft or unauthorized actions in the hosting application. Anyone running a PHP application that renders user-supplied Markdown with league/commonmark versions 2.7.0 or newer but below 2.9.1 and the AttributesExtension enabled is affected. A public proof-of-concept and security advisory (GHSA-f8fg-pg57-v4j8) exist, but there is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS estimates only about a 0.2% chance of exploitation within 30 days.

Do: Upgrade league/commonmark to version 2.9.1 or later, which restores correct attribute filtering. Until patched, disable the AttributesExtension for untrusted Markdown, or strip control characters (notably U+000C form feed) from user-supplied Markdown attribute names and validate href/src values to block javascript: URIs; audit whether your application registers AttributesExtension on user-provided input.

Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.

Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.