CVE-2025-29189CWE-89sql-injection

CVE-2025-29189

High · published April 9, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-09T16:15Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise≤ 2.2.3—
References (2)
https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing · [email protected]https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 APR 00:00Z
    Flowise <= 2.2.3 is vulnerable to SQL Injection
    cvelistv5