Flowise Vulnerable to SQL Injection via `tableName` Parameter

Description

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.2.3
• Patched version(s): 2.2.4

References

• GHSA-gjx9-wg9x-7gvp
• drive.google.com
• CVE-2025-29189
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
• Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
• Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

flowise-components