CVE-2024-36420: Flowise Path Injection at /api/v1/openai-assistants-file

August 5, 2024

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this issue are available.

References

github.com/FlowiseAI/Flowise
github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts
github.com/advisories/GHSA-h997-3fxj-p5j8
nvd.nist.gov/vuln/detail/CVE-2024-36420
securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise

Code Behaviors & Features

Detect and mitigate CVE-2024-36420 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →