Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI’s POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.0.13
• Patched version(s): 3.1.0

References

• GHSA-6r77-hqx7-7vw8
• CVE-2026-41271
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477
• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - CVE-2026-41264
• Flowise: Cypher Injection in GraphCypherQAChain - CVE-2026-41274
• Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

flowise-components