CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.4 are vulnerable due to a script injection flaw in Docker image build workflows, allowing attackers with repository write access to inject shell metacharacters into inputs such as tag_version and node_version. This could lead to the execution of arbitrary commands, potentially compromising AWS credentials and Docker Hub tokens. Organizations utilizing Flowise in their Docker workflows should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.