{"id":"CVE-2025-71331","revision":"f2d50d8e676541e7aff386d733879657","records":[{"revision":"f2d50d8e676541e7aff386d733879657","observedAt":"2026-11-08T15:04:17.023+00:00","statement":{"source":"cve-program","id":"CVE-2025-71331","aliases":[],"title":"Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows","description":"Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src=\"javascript:alert(document.cookie)\">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.","state":0,"publishedAt":"2026-06-20T15:24:39.877+00:00","modifiedAt":"2026-11-08T14:00:28.219+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Flowise\",\n                    \"product\": \"Flowise\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.0.8\"\n                        },\n                        {\n                            \"version\": \"3.0.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4fr9-3x69-36wv","https://www.vulncheck.com/advisories/flowise-cross-site-scripting-in-chat-messages-and-agent-workflows"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71331","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71331","identifiers":["CVE-2025-71331"]},"retained":false,"historicalAffected":[]}],"coverage":[]}