Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-91937

Flowise before 3.1.4 NoSQL Injection via sessionId

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FlowiseAI Flowise

Default version status: unaffected

  • 0 to < 3.1.4affected
  • 3.1.4unaffected
pkg:npm/flowise

References