Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-91934

Flowise before 3.1.4 Remote Code Execution via SQL Database Chain

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FlowiseAI Flowise

Default version status: unaffected

  • 0 to < 3.1.4affected
  • 3.1.4unaffected
pkg:npm/flowise

FlowiseAI Flowise

Default version status: unaffected

  • 0 to < 3.1.4affected
  • 3.1.4unaffected
pkg:npm/flowise-components

References