Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

FlowiseAI/Flowise

              main @ 9291856
            

123

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 19 prior fixes. Scrutinize any change in this area.

packages/server/src/index.ts: most-fixed (9 issues). Treat as high-risk during review.

99 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring missing RBAC permission checks and workspace/tenant scoping across numerous API endpoints, allowing unauthorized access to chatflows, executions, vector stores, assistants, and admin dashboards.

Path Traversal: Multiple file read/write operations accept unsanitized paths or filenames, enabling attackers to read/write arbitrary files outside intended directories.

SSRF: User-controlled URLs are fetched without consistent deny-list validation, DNS rebinding protection, or redirect-chain checks, allowing access to internal services.