Description
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.2.3
- Patched version(s): 2.2.4
References
Could your website be exposed too?
SmartScanner can check your website for Flowise Vulnerable to SQL Injection via `tableName` Parameter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
- Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
You might also like:
See something that needs correcting? Let us knowUpdated April 10, 2025